CVE-2024-38618

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2024-38618
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38618.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2024-38618
Downstream
Related
Published
2024-06-19T13:56:17.422Z
Modified
2026-05-28T03:52:45.786952375Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L CVSS Calculator
Summary
ALSA: timer: Set lower bound of start tick time
Details

In the Linux kernel, the following vulnerability has been resolved:

ALSA: timer: Set lower bound of start tick time

Currently ALSA timer doesn't have the lower limit of the start tick time, and it allows a very small size, e.g. 1 tick with 1ns resolution for hrtimer. Such a situation may lead to an unexpected RCU stall, where the callback repeatedly queuing the expire update, as reported by fuzzer.

This patch introduces a sanity check of the timer start tick time, so that the system returns an error when a too small start size is set. As of this patch, the lower limit is hard-coded to 100us, which is small enough but can still work somehow.

Database specific 
{
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/38xxx/CVE-2024-38618.json",
    "cna_assigner": "Linux"
}
References

Affected packages

Git / git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git

Affected ranges

Type
GIT
Repo
https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git
Events
Introduced
bbaf5e97337287479eb78dbc3822d9560bbfd2e2
Fixed
68396c825c43664b20a3a1ba546844deb2b4e48f
Fixed
74bfb8d90f2601718ae203faf45a196844c01fa1
Fixed
bdd0aa055b8ec7e24bbc19513f3231958741d0ab
Fixed
83f0ba8592b9e258fd80ac6486510ab1dcd7ad6e
Fixed
ceab795a67dd28dd942d0d8bba648c6c0f7a044b
Fixed
2c95241ac5fc90c929d6c0c023e84bf0d30e84c3
Fixed
abb1ad69d98cf1ff25bb14fff0e7c3f66239e1cd
Fixed
4a63bd179fa8d3fcc44a0d9d71d941ddd62f0c4e

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38618.json"

Linux / Kernel

Package

Name
Kernel

Affected ranges

Type
ECOSYSTEM
Events
Introduced
2.6.29
Fixed
4.19.316
Type
ECOSYSTEM
Events
Introduced
4.20.0
Fixed
5.4.278
Type
ECOSYSTEM
Events
Introduced
5.5.0
Fixed
5.10.219
Type
ECOSYSTEM
Events
Introduced
5.11.0
Fixed
5.15.161
Type
ECOSYSTEM
Events
Introduced
5.16.0
Fixed
6.1.93
Type
ECOSYSTEM
Events
Introduced
6.2.0
Fixed
6.6.33
Type
ECOSYSTEM
Events
Introduced
6.7.0
Fixed
6.9.3

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2024-38618.json"