Vulnerability in Linux
CVE-2024-57893
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: oss: Fix races at processing SysEx messages OSS sequencer handles the SysEx messages split in 6 bytes packets, and ALSA sequencer OSS layer tries to combine those. It stores the data in the internal buffer and this access is racy as of now, which may lead to the out-of-bounds access. As a temporary band-aid fix, introduce a mutex for serializing the process of the SysEx message packets.
Vulnerability class: Race Condition
EPSS: 0.002 (5.4th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H.
Affected products
- Linux — versions 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2, 2.6.12, 0
- Linux Linux_kernel — versions 6.13
Weakness classification (CWE)
Public proof-of-concept exploits
References
Frequently asked questions
- What is CVE-2024-57893?
- CVE-2024-57893 is a high-severity vulnerability in Linux, classified under Concurrent Execution using Shared Resource with Improper Synchronization (Race Condition). CVSS score: 7.8/10. Published 2025-01-15.
- How severe is CVE-2024-57893?
- High severity. CVSS v3 base score is 7.8 out of 10.
- Is CVE-2024-57893 known to be exploited?
- 3 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.