CVE-2024-57893

In the Linux kernel, the following vulnerability has been resolved:

ALSA: seq: oss: Fix races at processing SysEx messages

OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access.

As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.

This vulnerability is rated as having Moderate impact because it requires local access to audio sequencer devices and precise timing to trigger a race condition, resulting in an out-of-bounds read or write that could cause a denial of service or information disclosure. The legacy OSS sequencer interface is not used in standard enterprise server environments or containerized workloads, significantly limiting attack surface exposure. In default configurations, unprivileged users do not possess direct access to sound device interfaces unless explicitly granted.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.