Linux Kernel ALSA Raw MIDI Output Teardown Vulnerability Leading to Use-After-Free

A vulnerability in the Linux kernel's ALSA subsystem for sequencer UMP (Universal MIDI Packet) handling can lead to a use-after-free condition. The issue arises because the function 'seq_ump_process_event()' accesses the output file of a client without proper synchronization. This can cause the last closure of the output to release the associated raw MIDI file while an event callback is still processing, potentially allowing the runtime of the raw MIDI substream to be freed prematurely. The vulnerability has been addressed by introducing a per-client read-write lock to manage access to the output file, ensuring that the output teardown process is properly synchronized with ongoing event processing.

Impact

Exploitation of this vulnerability causes a slab-based use-after-free error in the 'snd_rawmidi_kernel_write1()' function, which can lead to memory corruption.

Reproduction

The vulnerability can be reproduced by creating a scenario where 'seq_ump_process_event()' is called and accesses 'client->out_rfile.output' while 'snd_rawmidi_kernel_write1()' is still in progress. This can be achieved by connecting a UMP device to a sequencer client, opening a raw MIDI output file, and then triggering an event input before properly closing the output file. The Kernel Address Sanitizer (KASAN) can be used to validate the reproduction, as it will report the use-after-free error.

Remediation

Users should update to the latest version of the Linux kernel where this vulnerability has been fixed.