Linux Kernel ALSA PCM OSS Uninitialized Memory Vulnerability Allowing Use-After-Free

A use-after-free vulnerability has been identified in the Linux kernel's Advanced Linux Sound Architecture (ALSA) PCM OSS subsystem. This issue arises in versions of the Linux kernel prior to the latest stable release. The vulnerability occurs in the 'snd_pcm_oss_proc_write()' function, which improperly manages memory when linking setup entries. If the allocation of a task name fails, the function frees the linked entry but leaves the setup list pointing to the freed memory. This creates a scenario where a subsequent OSS device open can access and dereference the invalid memory, leading to potential exploitation.

Impact

Exploitation of this vulnerability can cause a use-after-free condition, allowing for the dereferencing of freed memory, which can be manipulated to execute arbitrary code or cause a kernel crash.

Reproduction

The vulnerability can be reproduced by writing to the OSS proc interface for a PCM device. The 'snd_pcm_oss_proc_write()' function will attempt to allocate memory for the task name. If this allocation fails, the function will free the already linked setup entry, creating a use-after-free condition. This can be verified by opening the OSS device, which will trigger the 'snd_pcm_oss_look_for_setup()' function to traverse the setup list and access the freed memory.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. Instructions for upgrading the Linux kernel can be found in the official Linux documentation.