Linux Kernel ALSA UMP Buffer Overflow Vulnerability in SysEx Message Conversion

A buffer overflow vulnerability has been identified in the Linux kernel's Advanced Linux Sound Architecture (ALSA) Universal MIDI Packet (UMP) message handling. The issue arises in the conversion function from MIDI 1.0 to UMP, which uses an internal buffer designed to hold incoming MIDI bytes. This buffer, originally sized for a maximum of 4 bytes, fails to accommodate the full 6-byte potential of longer System Exclusive (SysEx) messages. As a result, when a lengthy SysEx message is received, the overflow can lead to memory corruption. The vulnerability has been addressed by increasing the buffer size to 6 bytes to properly align with the UMP representation of SysEx messages.

Impact

Exploitation of this vulnerability can lead to a buffer overflow, causing memory corruption.