Takashi Iwai

تم تحديد مشكلة توقف في نواة لينكس تتعلق ببرنامج تشغيل الإدخال synaptics. عند تمكين منفذ تمرير (pass-through)، قد يحدث انقطاع قبل أن يرتبط برنامج تشغيل psmouse بالمنفذ. يحاول برنامج التشغيل الفرعي synaptics الوصول إلى مثيل psmouse المرتبط بمنفذ التمرير، مما قد يتسبب في تعطل النظام إذا لم يكن مثيل psmouse قد تم ربطه بالمنفذ بعد. يتم حل هذه المشكلة عن طريق إدخال طرق لفتح وإغلاق المنفذ والتحقق من أن المنفذ مفتوح قبل الوصول إلى مثيل psmouse.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: A vulnerability in the Linux kernel has been resolved, specifically in the parport component, related to an array out-of-bounds access. The issue arose from replacing `sprintf()` calls with `snprintf()`, which returns the would-be-printed size, not the actual output size, potentially leading to length calculations exceeding the given limit. To address this, `scnprintf()` is used instead, as it returns the actual output letters. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to a deadlock in the ALSA component of the Linux kernel, specifically in the `snd card disconnect()` function. This occurs when a process waits for power up at `snd power ref and wait()` in `snd ctl info()` or read/write() inside `card->controls rwsem`, and the system gets disconnected meanwhile, causing the driver to try to delete a kctl via `snd ctl remove*()`. The fix involves waking up sleepers before processing the driver disconnect callbacks but right after setting the `card->shutdown` flag. This change allows the code to flow again without deadlocks. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

The issue is related to a use-after-free bug in the ALSA subsystem of the Linux kernel. This bug occurs when the `snd pcm substream` is closing, and the `aica channel` is deallocated but can still be dereferenced in the worker thread. The reason for this is that `del timer()` returns directly, regardless of whether the timer handler is running or not, and the worker could be rescheduled in the timer handler. To mitigate this bug, the `mod timer()` function should be called conditionally in `run spu dma()`, and a PCM sync stop operation should be implemented to cancel both the timer and worker.

The issue is related to the ALSA hda component of the Linux kernel, where unsetting the preset in `snd hda codec cleanup for unbind()` interferes with the module unload and load scenario, causing a null pointer dereference. This occurs because the `snd hda codec device new()` function expects a valid pointer to an instance of `struct snd card`, which can only be met once sound card components probing commences. The `preset` is assigned only once during device/driver matching, and the ASoC codec driver's module reloading may occur several times throughout the lifetime of an audio stack.

تتعلق المشكلة بنقص الحماية ضد التغييرات المتزامنة في التخصيص المسبق لمخزن PCM المؤقت عبر ملفات proc في نواة Linux، مما قد يؤدي إلى مشكلات «الاستخدام بعد التحرير» (UAF) أو مشكلات أخرى. تنشأ المشكلة عن عدم وجود تزامن أثناء عمليات الكتابة في ملفات proc وفتح تدفقات PCM.

The vulnerability is related to the ipmi: ssif component in the Linux kernel. It causes a kernel crash when an error path is taken during the probe of ssif info->client. The issue arises because ssif info->client is dereferenced in the error path before some error checking has been done. To resolve this, ssif info->client should be initialized before any error path can be taken, and i2c client data should be cleared in the error path to prevent a dangling pointer from leaking.

A null pointer dereference issue has been identified in the Linux kernel, specifically in the ALSA component. The problem arises when the function `free pages exact()` is called with a NULL address, which can lead to a system compromise. The issue is resolved by adding a proper NULL check to avoid possible errors.

The issue is related to the snd timer user params function in the sound/core/timer.c file of the Linux kernel. This function does not properly initialize a certain data structure, allowing local users to obtain sensitive information from kernel stack memory. This can be achieved through crafted use of the ALSA timer interface.