Executive brief
The Linux kernel contains a buffer overflow vulnerability in the ALSA (Advanced Linux Sound Architecture) Line6 USB audio driver's MIDI handling code. When multiple MIDI system exclusive (sysex) messages are sent to a PODxt device, the code fails to properly calculate available buffer space, allowing an attacker to overflow a stack buffer and potentially execute arbitrary code or crash the system.
Technical details
The vulnerability is a stack buffer overflow in the line6_midi_transmit() function within sound/usb/line6/midi.c. The root cause is incorrect calculation of available space in the MIDI buffer; the code used min() with only two parameters (bytes_free and max_packet_size) instead of min3() to also account for the size of the chunk buffer itself. This precondition requires sending multiple MIDI sysex messages to a connected PODxt device. An attacker with local access to send MIDI messages to the device can overflow the stack buffer, potentially leading to denial of service or code execution. The fix, committed upstream in December 2022, corrects the buffer space calculation by using min3() to include the chunk buffer size as a third constraint.
Affected products
- Linux Linux kernel Multiple versions; patch available in mainline and stable trees
Timeline
- 2022-12-25: disclosed
- 2023-01-12: patched: Patch merged into stable trees