CVE - CVE-2021-47281

CVE-ID
CVE-2021-47281	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix race of snd_seq_timer_open() The timer instance per queue is exclusive, and snd_seq_timer_open() should have managed the concurrent accesses. It looks as if it's checking the already existing timer instance at the beginning, but it's not right, because there is no protection, hence any later concurrent call of snd_seq_timer_open() may override the timer instance easily. This may result in UAF, as the leftover timer instance can keep running while the queue itself gets closed, as spotted by syzkaller recently. For avoiding the race, add a proper check at the assignment of tmr->timeri again, and return -EBUSY if it's been already registered.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
MISC:https://git.kernel.org/stable/c/536a7646c00a0f14fee49e5e313109e5da2f6031 URL:https://git.kernel.org/stable/c/536a7646c00a0f14fee49e5e313109e5da2f6031 MISC:https://git.kernel.org/stable/c/83e197a8414c0ba545e7e3916ce05f836f349273 URL:https://git.kernel.org/stable/c/83e197a8414c0ba545e7e3916ce05f836f349273 MISC:https://git.kernel.org/stable/c/bd7d88b0874f82f7b29d1a53e574cedaf23166ba URL:https://git.kernel.org/stable/c/bd7d88b0874f82f7b29d1a53e574cedaf23166ba
Assigning CNA
kernel.org
Date Record Created
20240521	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20240521)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)