ALSA: rawmidi - fix the uninitalized user_pversion (Linux Linux)
At a glance
- Source
- NVD
- EPSS
- EPSS 0.21 % · percentile 11 ()
- State
- PUBLISHED
- Published
- Updated
- Assigner
- Linux
- NVD status
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: rawmidi - fix the uninitalized user_pversion The user_pversion was uninitialized for the user space file structure in the open function, because the file private structure use kmalloc for the allocation. The kernel ALSA sequencer code clears the file structure, so no additional fixes are required. BugLink: https://github.com/alsa-project/alsa-lib/issues/178
Weaknesses (CWE)
- CWE-908 — Use of Uninitialized Resource
References
Scores
| Version | Score | Vector | Scored by |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | CISA-ADP |
| CVSS 3.1 | MEDIUM 4.0 | CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N | NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary) |
European references
- ENISA EUVD · EUVD-2021-33744
- GCVE · GCVE-0-2021-47096
CERT-FR advisories
- CERTFR-2024-AVI-0363 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0329 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Affected configurations (NVD CPE)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15 < 5.15.12cpe:2.3:o:linux:linux_kernel:5.16:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.16:rc6:*:*:*:*:*:*
Affected products
| Product | Versions |
|---|---|
| Linux · Linux | affected 09d23174402da0f10e98da2c61bb5ac8e7d79fdd < b398fcbe4de1e1100867fdb6f447c6fbc8fe7085 ; affected 09d23174402da0f10e98da2c61bb5ac8e7d79fdd < 39a8fc4971a00d22536aeb7d446ee4a97810611b ; affected 12d50801497235956fb3760be8530f4e44e4ce67 ; affected 5.14.10 < 5.15 |
| Linux · Linux | affected 5.15 ; unaffected 0 < 5.15 ; unaffected 5.15.12 ≤ 5.15.* ; unaffected 5.16 ≤ * |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |