CVE-2024-42274

Technical Description

In the Linux kernel, the following vulnerability has been resolved:

Revert "ALSA: firewire-lib: operate for period elapse event in process context"

Commit 7ba5ca32fe6e ("ALSA: firewire-lib: operate for period elapse event

in process context") removed the process context workqueue from

amdtp_domain_stream_pcm_pointer() and update_pcm_pointers() to remove

its overhead.

With RME Fireface 800, this lead to a regression since

Kernels 5.14.0, causing an AB/BA deadlock competition for the

substream lock with eventual system freeze under ALSA operation:

thread 0:

* (lock A) acquire substream lock by

snd_pcm_stream_lock_irq() in

snd_pcm_status64()

* (lock B) wait for tasklet to finish by calling

tasklet_unlock_spin_wait() in

tasklet_disable_in_atomic() in

ohci_flush_iso_completions() of ohci.c

thread 1:

* (lock B) enter tasklet

* (lock A) attempt to acquire substream lock,

waiting for it to be released:

snd_pcm_stream_lock_irqsave() in

snd_pcm_period_ela

Remediation

Check the references section for vendor advisories and patches from linux. Update linux_kernel to the latest patched version. If immediate patching is not possible, review the CVSS vector to understand the attack surface and apply compensating controls such as network segmentation or access restrictions.

Affected Products

References