In the Linux kernel, the following vulnerability has been resolved:
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around.
This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur.
This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero
UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
CVSS Details
- CVSS 3.1 Base Score: 7.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kernel-rt-optionalUpgrade dtb-sprdUpgrade kernel-rt-livepatch-develUpgrade kernel-kvmsmall-vdsoUpgrade kernel-rt_debugUpgrade kernel-source-rtUpgrade kernel-debug-develUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-preempt-develUpgrade dlm-kmp-rtUpgrade kernel-default-manUpgrade kernel-docsUpgrade kernel-default-livepatch-develUpgrade dtb-hisiliconUpgrade kernel-64kb-develUpgrade kernel-rt-extraUpgrade kernel-docs-htmlUpgrade dlm-kmp-defaultUpgrade reiserfs-kmp-defaultUpgrade dtb-marvellUpgrade kernel-default-baseUpgrade dtb-broadcomUpgrade cluster-md-kmp-64kbUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-obs-buildUpgrade kernel-64kb-extraUpgrade dtb-socionextUpgrade kernel-azure-baseUpgrade kselftests-kmp-rtUpgrade kernel-azure-extraUpgrade kernel-debug-livepatch-develUpgrade dtb-renesasUpgrade kernel-azureUpgrade dtb-amdUpgrade dtb-armUpgrade kernel-azure-vdsoUpgrade kernel-defaultUpgrade dtb-nvidiaUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade ocfs2-kmp-azureUpgrade reiserfs-kmp-64kbUpgrade kernel-debugUpgrade dtb-appleUpgrade dlm-kmp-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-syms-rtUpgrade cluster-md-kmp-defaultUpgrade kselftests-kmp-defaultUpgrade dtb-amlogicUpgrade kernel-rt-livepatchUpgrade kernel-macrosUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade dtb-exynosUpgrade dtb-caviumUpgrade cluster-md-kmp-rtUpgrade ocfs2-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade kernel-kvmsmall-develUpgrade kernel-rt-vdsoUpgrade gfs2-kmp-azureUpgrade kernel-azure-develUpgrade kernel-syms-azureUpgrade dtb-amazonUpgrade kernel-default-vdsoUpgrade dtb-lgUpgrade kernel-source-vanillaUpgrade dtb-apmUpgrade kernel-symsUpgrade kernel-rt_debug-develUpgrade kernel-default-base-rebuildUpgrade dlm-kmp-64kbUpgrade dtb-alteraUpgrade kernel-default-optionalUpgrade cluster-md-kmp-azureUpgrade kselftests-kmp-azureUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-source-azureUpgrade kernel-obs-qaUpgrade kernel-devel-rtUpgrade dtb-xilinxUpgrade dtb-allwinnerUpgrade reiserfs-kmp-azureUpgrade gfs2-kmp-rtUpgrade kernel-develUpgrade kernel-kvmsmallUpgrade kernel-azure-optionalUpgrade kernel-default-develUpgrade kernel-64kbUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatchUpgrade kernel-sourceUpgrade kernel-preemptUpgrade dtb-rockchipUpgrade kernel-rt-develUpgrade kernel-default-extraUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade kernel-64kb-livepatch-devel | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-gcpUpgrade linux-kvmUpgrade linux-fipsUpgrade linux-nvidiaUpgrade linux-bluefieldUpgrade linux-oracle-5.4Upgrade linux-aws-fipsUpgrade linux-raspi-5.4Upgrade linux-gcp-5.4Upgrade linux-ibm-5.4Upgrade linux-riscv-5.15Upgrade linux-gcp-fipsUpgrade linux-oracleUpgrade linux-intel-iotgUpgrade linux-ibmUpgrade linux-hwe-5.4Upgrade linux-hwe-5.15Upgrade linux-azure-fipsUpgrade linux-raspiUpgrade linux-aws-5.15Upgrade linux-realtimeUpgrade linux-azure-5.4Upgrade linux-iotUpgrade linux-gcp-5.15Upgrade linux-gkeop-5.15Upgrade linux-hweUpgrade linux-aws-hweUpgrade linux-gkeUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-5.15Upgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-azure-fde-5.15Upgrade linux-lowlatencyUpgrade linux-gkeopUpgrade linuxUpgrade linux-oracle-5.15Upgrade linux-gcp-4.15Upgrade linux-azure-fdeUpgrade linux-intel-iotg-5.15Upgrade linux-aws-5.4Upgrade linux-aws | Nov 19, 2024 | May 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub