In the Linux kernel, the following vulnerability has been resolved:
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around.
This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur.
This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero
UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | May 3, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | May 3, 2024 |
| Suse | — | Upgrade kselftests-kmp-defaultUpgrade kernel-syms-rtUpgrade dlm-kmp-azureUpgrade kernel-debug-develUpgrade cluster-md-kmp-defaultUpgrade kernel-rt_debugUpgrade kernel-debug-vdsoUpgrade kernel-kvmsmall-vdsoUpgrade reiserfs-kmp-rtUpgrade dtb-socionextUpgrade kernel-azure-vdsoUpgrade dtb-appleUpgrade reiserfs-kmp-64kbUpgrade kernel-azure-extraUpgrade dtb-marvellUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-kvmsmall-livepatch-develUpgrade gfs2-kmp-defaultUpgrade kernel-64kb-optionalUpgrade kernel-defaultUpgrade kernel-azure-baseUpgrade kernel-source-rtUpgrade dtb-hisiliconUpgrade dtb-nvidiaUpgrade kernel-obs-buildUpgrade kernel-debugUpgrade kernel-debug-livepatch-develUpgrade kernel-default-livepatch-develUpgrade kernel-default-baseUpgrade kernel-docs-htmlUpgrade reiserfs-kmp-defaultUpgrade dtb-sprdUpgrade cluster-md-kmp-64kbUpgrade kernel-rt-livepatch-develUpgrade kernel-rt_debug-vdsoUpgrade dtb-broadcomUpgrade kernel-rt-optionalUpgrade kernel-64kb-develUpgrade dtb-amdUpgrade kernel-preempt-develUpgrade dtb-armUpgrade kernel-64kb-extraUpgrade kernel-azureUpgrade dtb-renesasUpgrade kernel-docsUpgrade kernel-default-manUpgrade dlm-kmp-rtUpgrade kselftests-kmp-rtUpgrade kernel-rt-extraUpgrade ocfs2-kmp-azureUpgrade kernel-azure-optionalUpgrade gfs2-kmp-rtUpgrade dtb-rockchipUpgrade kernel-default-livepatchUpgrade kernel-develUpgrade kernel-sourceUpgrade kernel-rt-vdsoUpgrade kernel-preemptUpgrade kernel-kvmsmall-develUpgrade kernel-default-extraUpgrade kernel-default-base-rebuildUpgrade kernel-devel-rtUpgrade reiserfs-kmp-azureUpgrade kernel-source-azureUpgrade kselftests-kmp-azureUpgrade cluster-md-kmp-azureUpgrade kernel-symsUpgrade kernel-source-vanillaUpgrade kernel-rt_debug-develUpgrade gfs2-kmp-azureUpgrade kernel-obs-qaUpgrade dtb-allwinnerUpgrade kernel-default-optionalUpgrade kernel-64kbUpgrade dtb-xilinxUpgrade kernel-rt-develUpgrade dtb-apmUpgrade ocfs2-kmp-64kbUpgrade gfs2-kmp-64kbUpgrade dtb-amlogicUpgrade cluster-md-kmp-rtUpgrade dtb-caviumUpgrade ocfs2-kmp-rtUpgrade kernel-zfcpdumpUpgrade kernel-devel-azureUpgrade kernel-azure-livepatch-develUpgrade dtb-lgUpgrade dtb-amazonUpgrade dtb-alteraUpgrade kernel-macrosUpgrade kernel-default-vdsoUpgrade kernel-azure-develUpgrade dlm-kmp-64kbUpgrade kernel-syms-azureUpgrade kernel-rt-livepatchUpgrade kernel-64kb-livepatch-develUpgrade dtb-exynosUpgrade dtb-qcomUpgrade dtb-freescaleUpgrade ocfs2-kmp-defaultUpgrade dtb-mediatekUpgrade kselftests-kmp-64kbUpgrade kernel-rtUpgrade kernel-kvmsmallUpgrade kernel-default-devel | Aug 9, 2024 | May 3, 2024 |
| Ubuntu | — | Upgrade linux-intel-iotgUpgrade linux-gcp-fipsUpgrade linux-ibm-5.4Upgrade linux-bluefieldUpgrade linux-hwe-5.4Upgrade linux-raspi-5.4Upgrade linux-oracle-5.4Upgrade linux-fipsUpgrade linux-gcp-5.4Upgrade linux-gcpUpgrade linux-ibmUpgrade linux-riscv-5.15Upgrade linux-nvidiaUpgrade linux-oracleUpgrade linux-aws-fipsUpgrade linux-kvmUpgrade linux-aws-hweUpgrade linux-aws-5.15Upgrade linux-azureUpgrade linux-azure-4.15Upgrade linux-iotUpgrade linux-azure-fde-5.15Upgrade linux-gkeop-5.15Upgrade linux-azure-5.4Upgrade linux-gkeUpgrade linux-oracle-5.15Upgrade linux-gkeopUpgrade linuxUpgrade linux-lowlatencyUpgrade linux-gcp-5.15Upgrade linux-hweUpgrade linux-raspiUpgrade linux-lowlatency-hwe-5.15Upgrade linux-azure-fipsUpgrade linux-realtimeUpgrade linux-awsUpgrade linux-azure-fdeUpgrade linux-gcp-4.15Upgrade linux-intel-iotg-5.15Upgrade linux-azure-5.15Upgrade linux-hwe-5.15Upgrade linux-aws-5.4 | Nov 19, 2024 | May 3, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Jan 20, 2025 | May 3, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub