CVE-2024-38618

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-38618
In the Linux kernel, the following vulnerability has been resolved: ALSA: timer: Set lower bound of start tick time Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer. This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.

5.5 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 Patch
https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e Patch
https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f Patch
https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 Patch
https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e Patch
https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd Patch
https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab Patch
https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b Patch
https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 Patch
https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e Patch
https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f Patch
https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 Patch
https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e Patch
https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd Patch
https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab Patch
https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
History

03 Oct 2025, 16:07

Type Values Removed Values Added
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
References () https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 - () https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 - Patch
References () https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e - () https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e - Patch
References () https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f - () https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f - Patch
References () https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 - () https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 - Patch
References () https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e - () https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e - Patch
References () https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd - () https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd - Patch
References () https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab - () https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab - Patch
References () https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b - () https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b - Patch
CWE NVD-CWE-noinfo
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : 5.3 		v2 : unknown
v3 : 5.5

21 Nov 2024, 09:26

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 - () https://git.kernel.org/stable/c/2c95241ac5fc90c929d6c0c023e84bf0d30e84c3 -
References () https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e - () https://git.kernel.org/stable/c/4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e -
References () https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f - () https://git.kernel.org/stable/c/68396c825c43664b20a3a1ba546844deb2b4e48f -
References () https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 - () https://git.kernel.org/stable/c/74bfb8d90f2601718ae203faf45a196844c01fa1 -
References () https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e - () https://git.kernel.org/stable/c/83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e -
References () https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd - () https://git.kernel.org/stable/c/abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd -
References () https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab - () https://git.kernel.org/stable/c/bdd0aa055b8ec7e24bbc19513f3231958741d0ab -
References () https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b - () https://git.kernel.org/stable/c/ceab795a67dd28dd942d0d8bba648c6c0f7a044b -

08 Nov 2024, 22:35

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 5.3

15 Jul 2024, 07:15

Type Values Removed Values Added
References
  • {'url': 'https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html', 'source': '416baaa9-dc9f-4396-8d5f-8c081fb06d67'}

27 Jun 2024, 12:15

Type Values Removed Values Added
References
  • () https://lists.debian.org/debian-lts-announce/2024/06/msg00020.html -

20 Jun 2024, 12:43

Type Values Removed Values Added
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: temporizador: establece el límite inferior del tiempo de inicio. Actualmente, el temporizador ALSA no tiene el límite inferior del tiempo de inicio y permite un tamaño muy pequeño, por ejemplo, 1 tic. con resolución de 1ns para hrtimer. Tal situación puede provocar una parada inesperada de la RCU, donde la devolución de llamada pone en cola repetidamente la actualización caducada, según lo informado por fuzzer. Este parche introduce una verificación de cordura del tiempo de inicio del temporizador, de modo que el sistema devuelve un error cuando se establece un tamaño de inicio demasiado pequeño. A partir de este parche, el límite inferior está codificado en 100us, que es bastante pequeño pero aún puede funcionar de alguna manera.

19 Jun 2024, 14:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-06-19 14:15

Updated : 2025-10-03 16:07

NVD link : CVE-2024-38618

Mitre link : CVE-2024-38618

CVE.ORG link : CVE-2024-38618

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
NVD-CWE-noinfo