CVE-2023-54072

Vulnerability

Analysis

CVE-2023-54072 describes a data race in the Linux kernel's ALSA PCM subsystem. The issue resides in the do_alloc_pages() helper, which performs a sanity check against too many buffer allocations. However, this check is executed without holding the proper lock (the proper lock, specifically card->memory_mutex, and the allocation itself is not serialized. This race condition allows a user to allocate more memory than the predefined maximum size, effectively bypassing the intended soft limit.

The attack surface involves unprivileged access to the ALSA PCM interface. The vulnerability can be triggered by a user with the ability to initiate multiple PCM buffer allocations concurrently. The race condition means that the check for total allocated size is evaluated using stale data, allowing new allocations to proceed even when the limit has been reached. No authentication beyond having a user account capable of accessing the sound device is required; the attacker must be able to run code on the system with appropriate permissions to allocate PCM buffers.

In practice, this is considered a soft-limit bypass rather than a severe security issue. The impact is limited because it is not possible to allocate unlimited memory; the system will eventually run out of memory or hit other constraints. However, an attacker could cause excessive memory consumption, potentially leading to denial of service by exhausting memory resources, or cause unexpected behavior in audio subsystems. The kernel lacks proper synchronization, making the limit ineffective in a multithreaded scenario.

The patch fixes the race by covering the size check with the card->memory_mutex and correctly updating the allocated size under lock. On allocation failure, the size is decreased accordingly. The fix has been backported to stable kernel trees, as indicated by commits [1], [2], and [3]. Users are advised to update their kernels to include the patch. No workaround other than applying the kernel update is available, as the issue exists in the core ALSA code.