kernel: race condition in snd_seq_write() may lead to UAF or OOB-access

ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access...

PT-2018-1071

Name of the Vulnerable Software and Affected Versions Linux kernel versions 2.6 through 4.12 Description A race condition issue exists in the sound system of the Linux kernel, potentially leading to a deadlock and denial of service condition. The vulnerability is related to the snd seq write and...