CVE-2022-50719

Vulnerability

A stack buffer overflow vulnerability exists in the line6_midi_transmit function of the Linux kernel's ALSA line6 driver. The root cause is an incorrect calculation of available buffer space that fails to account for the size of the chunk buffer. This leads to a buffer overflow when multiple MIDI System Exclusive (sysex) messages are sent to a PODxt device.

Exploitation

An attacker with local access to a system using the line6 driver can send crafted MIDI sysex messages to a connected PODxt device. No authentication is required beyond the ability to interact with the device via MIDI. The overflow occurs on the stack, enabling memory corruption.

Impact

Successful exploitation can corrupt stack memory, potentially causing denial of service or arbitrary code execution in kernel context. This could lead to system instability or privilege escalation.

Mitigation

The fix has been applied to the Linux kernel stable tree [1][2][3]. Users should update to a patched kernel version.