Vulnerability · Published Aug 17, 2024 · Assigned by Linux

CVE-2024-42274Revert "ALSA: firewire-lib: operate for period elapse event in process context"

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 6% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 93.7% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: Revert "ALSA: firewire-lib: operate for period elapse event in process context" Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") removed the process context workqueue from amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove its overhead. With RME Fireface 800, this lead to a regression since Kernels 5.14.0, causing an AB/BA deadlock competition for the substream lock with eventual system freeze under ALSA operation: thread 0: * (lock A) acquire substream lock by snd_pcm_stream_lock_irq() in snd_pcm_status64() * (lock B) wait for tasklet to finish by calling tasklet_unlock_spin_wait() in tasklet_disable_in_atomic() in ohci_flush_iso_completions() of ohci.c thread 1: * (lock B) enter tasklet * (lock A) attempt to acquire substream lock, waiting for it to be released: snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed() in update_pcm_pointers() in process_ctx_payloads() in process_rx_packets() of amdtp-stream.c ? tasklet_unlock_spin_wait </NMI> <TASK> ohci_flush_iso_completions firewire_ohci amdtp_domain_stream_pcm_pointer snd_firewire_lib snd_pcm_update_hw_ptr0 snd_pcm snd_pcm_status64 snd_pcm ? native_queued_spin_lock_slowpath </NMI> <IRQ> _raw_spin_lock_irqsave snd_pcm_period_elapsed snd_pcm process_rx_packets snd_firewire_lib irq_target_callback snd_firewire_lib handle_it_packet firewire_ohci context_tasklet firewire_ohci Restore the process context work queue to prevent deadlock AB/BA deadlock competition for ALSA substream lock of snd_pcm_stream_lock_irq() in snd_pcm_status64() and snd_pcm_stream_lock_irqsave() in snd_pcm_period_elapsed(). revert commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event in process context") Replace inline description to prevent future deadlock.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.106-1DEBIAN-CVE-2024-42274
Debian:13linux6.10.4-1DEBIAN-CVE-2024-42274
Debian:14linux6.10.4-1DEBIAN-CVE-2024-42274
Ubuntu:22.04:LTSlinux5.15.0-125.135UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux5.15.0-125.135USN-7100-1
Ubuntu:24.04:LTSlinux6.8.0-50.51UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux6.8.0-50.51USN-7154-1
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-aws5.15.0-1072.78USN-7100-2
Ubuntu:22.04:LTSlinux-aws5.15.0-1072.78UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-aws6.8.0-1020.22UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-aws6.8.0-1020.22USN-7154-1
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1020.22~22.04.1USN-7154-1
Ubuntu:22.04:LTSlinux-aws-6.86.8.0-1020.22~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure5.15.0-1075.84UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-azure6.8.0-1020.23UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-azure6.8.0-1020.23USN-7196-1
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1020.23~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-6.86.8.0-1020.23~22.04.1USN-7196-1
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1076.85.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-gcp5.15.0-1071.79USN-7100-1
Ubuntu:22.04:LTSlinux-gcp5.15.0-1071.79UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-gcp6.8.0-1019.21UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-gcp6.8.0-1019.21USN-7154-1
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-gcp-6.86.8.0-1019.21~22.04.1USN-7154-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1069.75USN-7100-1
Ubuntu:22.04:LTSlinux-gke5.15.0-1069.75UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-gke6.8.0-1015.19UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-gke6.8.0-1015.19USN-7154-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1055.62USN-7100-1
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1055.62UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-gkeop6.8.0-1002.4UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-50.51~22.04.1USN-7154-2
Ubuntu:22.04:LTSlinux-hwe-6.86.8.0-50.51~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-ibm5.15.0-1065.68UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-ibm5.15.0-1065.68USN-7100-1
Ubuntu:24.04:LTSlinux-ibm6.8.0-1017.17UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-ibm6.8.0-1017.17USN-7154-1
Ubuntu:22.04:LTSlinux-ibm-6.86.8.0-1017.17~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1067.73USN-7144-1
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1067.73UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-kvm5.15.0-1069.74USN-7100-1
Ubuntu:22.04:LTSlinux-kvm5.15.0-1069.74UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-125.135USN-7100-1
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-125.135UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-50.51.1USN-7154-1
Ubuntu:24.04:LTSlinux-lowlatency6.8.0-50.51.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-50.51.1~22.04.1USN-7154-1
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1067.68USN-7100-1
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1067.68UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1019.21USN-7155-1
Ubuntu:24.04:LTSlinux-nvidia6.8.0-1019.21UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1019.21~22.04.1USN-7155-1
Ubuntu:22.04:LTSlinux-nvidia-6.86.8.0-1019.21~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1019.21.1USN-7155-1
Ubuntu:24.04:LTSlinux-nvidia-lowlatency6.8.0-1019.21.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia-tegra5.15.0-1032.32UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-nvidia-tegra-igx5.15.0-1020.20UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1018.18UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-oem-6.86.8.0-1018.18USN-7154-1
Ubuntu:22.04:LTSlinux-oracle5.15.0-1070.76UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oracle5.15.0-1070.76USN-7100-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1017.18USN-7154-1
Ubuntu:24.04:LTSlinux-oracle6.8.0-1017.18UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1017.18~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-oracle-6.86.8.0-1017.18~22.04.1USN-7154-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1065.68USN-7100-1
Ubuntu:22.04:LTSlinux-raspi5.15.0-1065.68UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-raspi6.8.0-1016.18UBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-raspi6.8.0-1016.18USN-7154-1
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-riscv6.8.0-50.51.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-riscv-6.86.8.0-50.51.1~22.04.1UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2024-42274
Ubuntu:24.04:LTSlinux-xilinx6.8.0-1017.18UBUNTU-CVE-2024-42274
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1038.42USN-7100-1
Ubuntu:22.04:LTSlinux-xilinx-zynqmp5.15.0-1038.42UBUNTU-CVE-2024-42274

Affected products (as reported)

VendorProductVersions
Linux Linux 7ba5ca32fe6e8d2e153fb5602997336517b34743 – before 7c07220cf634002f93a87ca2252a32766850f2d17ba5ca32fe6e8d2e153fb5602997336517b34743 – before b239a37d68e8bc59f9516444da222841e3b13ba97ba5ca32fe6e8d2e153fb5602997336517b34743 – before f5043e69aeb2786f32e84132817a007a6430aa7d7ba5ca32fe6e8d2e153fb5602997336517b34743 – before 36c255db5a25edd42d1aca48e38b8e95ee5fd9ef7ba5ca32fe6e8d2e153fb5602997336517b34743 – before 3dab73ab925a51ab05543b491bf17463a48ca323
Linux Linux 5.14

References