{ "dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": { "cveId": "CVE-2024-42097", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-07-29T15:50:41.173Z", "datePublished": "2024-07-29T17:39:32.470Z", "dateUpdated": "2026-08-05T11:35:34.669Z" }, "containers": { "cna": { "providerMetadata": { "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2026-08-05T11:35:34.669Z" }, "descriptions": [ { "lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: emux: improve patch ioctl data validation\n\nIn load_data(), make the validation of and skipping over the main info\nblock match that in load_guspatch().\n\nIn load_guspatch(), add checking that the specified patch length matches\nthe actually supplied data, like load_data() already did." } ], "metrics": [ { "cvssV3_1": { "version": "3.1", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "baseScore": 7.8, "baseSeverity": "HIGH" }, "scenarios": [ { "lang": "en", "value": "AV:L - The vulnerable code is reached only through local device interfaces — `ioctl(SNDRV_EMUX_IOCTL_LOAD_PATCH)` on `/dev/snd/hwC*D*` or a `SEQ_FULLSIZE` `write()` on `/dev/sequencer` — with no network, adjacent-network, or removable-bus path into `load_guspatch()`/`load_data()`.\nAC:L - A single ioctl or write with an attacker-chosen `patch.len` decoupled from the supplied buffer triggers the condition deterministically; the attacker controls every field of `struct patch_info`, and there is no race to win or memory layout to guess.\nPR:L - Only an open file descriptor on the emux hwdep node or the OSS sequencer node is needed — no capability is checked anywhere along `snd_emux_hwdep_load_patch()`/`snd_emux_load_patch_seq_oss()` — and desktop sessions grant those nodes to the logged-in user via logind ACLs or `audio` group membership.\nUI:N - The attacker issues the patch-load ioctl or write entirely on their own; no other user has to open a file, mount anything, or take any action.\nS:U - The out-of-bounds accesses, integer overflows and crashes stay inside the kernel's own security authority in the ALSA emux/soundfont code; no VM, IOMMU, or sandbox boundary is crossed.\nC:H - The unvalidated `patch.len` drives an unbounded (up to 2 GB) read past the data the caller actually supplied, and the resulting sample descriptor records extents larger than the block `snd_emu10k1_synth_alloc()` returned, so the synth engine subsequently reads adjacent emu10k1-mapped host pages belonging to other samples and clients.\nI:H - The unchecked length propagates into `truesize`/`blocksize` arithmetic that overflows `int` into negative sizes reaching the allocator and the copy routines, leaves the sample descriptor's extents beyond the allocated synth block so the emu8000 write loop stores past it, and on pre-v5.5 branches produces a `copy_from_user()` with a ~2^64 length whose failure path executes an unbounded `memset(to, 0, n)` over kernel memory.\nA:H - The negative sizes hit `snd_BUG_ON()` in `__snd_util_mem_alloc()` and `snd_emu10k1_synth_copy_from_user()`, emitting kernel warning splats that panic the machine under `panic_on_warn`, while the error paths leak the allocated synth block and corrupt the `sflist->mem_used` accounting, and the pre-v5.5 wild `memset()` is an outright system kill." } ] } ], "affected": [ { "product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/synth/emux/soundfont.c" ], "versions": [ { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "40d7def67841343c10f8642a41031fecbb248bab", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "79d9a000f0220cdaba1682d2a23c0d0c61d620a3", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d23982ea9aa438f35a8c8a6305943e98a8db90f6", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "7a18293fd8d8519c2f7a03753bc1583b18e3db69", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d0ff2443fcbb472206d45a5d2a90cc694065804e", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "d8f5ce3cb9adf0c72e2ad6089aba02d7a32469c2", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "87039b83fb7bfd7d0e0499aaa8e6c049906b4d14", "status": "affected", "versionType": "git" }, { "version": "1da177e4c3f41524e886b7f1b8a0c1fc7321cac2", "lessThan": "89b32ccb12ae67e630c6453d778ec30a592a212f", "status": "affected", "versionType": "git" } ] }, { "product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": [ "sound/synth/emux/soundfont.c" ], "versions": [ { "version": "2.6.12", "status": "affected" }, { "version": "0", "lessThan": "2.6.12", "status": "unaffected", "versionType": "semver" }, { "version": "4.19.317", "lessThanOrEqual": "4.19.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.4.279", "lessThanOrEqual": "5.4.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.10.221", "lessThanOrEqual": "5.10.*", "status": "unaffected", "versionType": "semver" }, { "version": "5.15.162", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.1.97", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.6.37", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.9.8", "lessThanOrEqual": "6.9.*", "status": "unaffected", "versionType": "semver" }, { "version": "6.10", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix" } ] } ], "cpeApplicability": [ { "nodes": [ { "operator": "OR", "negate": false, "cpeMatch": [ { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "4.19.317" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.4.279" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.10.221" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "5.15.162" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.1.97" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.6.37" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.9.8" }, { "vulnerable": true, "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "versionStartIncluding": "2.6.12", "versionEndExcluding": "6.10" } ] } ] } ], "references": [ { "url": "https://git.kernel.org/stable/c/40d7def67841343c10f8642a41031fecbb248bab" }, { "url": "https://git.kernel.org/stable/c/79d9a000f0220cdaba1682d2a23c0d0c61d620a3" }, { "url": "https://git.kernel.org/stable/c/d23982ea9aa438f35a8c8a6305943e98a8db90f6" }, { "url": "https://git.kernel.org/stable/c/7a18293fd8d8519c2f7a03753bc1583b18e3db69" }, { "url": "https://git.kernel.org/stable/c/d0ff2443fcbb472206d45a5d2a90cc694065804e" }, { "url": "https://git.kernel.org/stable/c/d8f5ce3cb9adf0c72e2ad6089aba02d7a32469c2" }, { "url": "https://git.kernel.org/stable/c/87039b83fb7bfd7d0e0499aaa8e6c049906b4d14" }, { "url": "https://git.kernel.org/stable/c/89b32ccb12ae67e630c6453d778ec30a592a212f" } ], "title": "ALSA: emux: improve patch ioctl data validation", "x_generator": { "engine": "bippy-1.2.0" } }, "adp": [ { "title": "CVE Program Container", "references": [ { "url": "https://git.kernel.org/stable/c/40d7def67841343c10f8642a41031fecbb248bab", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/79d9a000f0220cdaba1682d2a23c0d0c61d620a3", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d23982ea9aa438f35a8c8a6305943e98a8db90f6", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/7a18293fd8d8519c2f7a03753bc1583b18e3db69", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d0ff2443fcbb472206d45a5d2a90cc694065804e", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/d8f5ce3cb9adf0c72e2ad6089aba02d7a32469c2", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/87039b83fb7bfd7d0e0499aaa8e6c049906b4d14", "tags": [ "x_transferred" ] }, { "url": "https://git.kernel.org/stable/c/89b32ccb12ae67e630c6453d778ec30a592a212f", "tags": [ "x_transferred" ] }, { "url": "https://lists.debian.org/debian-lts-announce/2025/01/msg00001.html" } ], "providerMetadata": { "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2025-11-03T22:01:32.160Z" } }, { "metrics": [ { "other": { "type": "ssvc", "content": { "id": "CVE-2024-42097", "role": "CISA Coordinator", "options": [ { "Exploitation": "none" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "version": "2.0.3", "timestamp": "2024-09-10T16:18:18.485738Z" } } } ], "title": "CISA ADP Vulnrichment", "providerMetadata": { "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-09-11T17:33:00.102Z" } }, { "x_adpType": "supplier", "providerMetadata": { "orgId": "0b142b55-0307-4c5a-b3c9-f314f3fb7c5e", "shortName": "siemens-SADP", "dateUpdated": "2026-05-12T11:56:38.537Z" }, "affected": [ { "vendor": "Siemens", "product": "SIMATIC S7-1500 TM MFP - GNU/Linux subsystem", "versions": [ { "status": "affected", "version": "0", "lessThan": "*", "versionType": "custom" } ], "defaultStatus": "unknown" } ], "references": [ { "url": "https://cert-portal.siemens.com/productcert/html/ssa-265688.html" } ] } ] } }