When an audio channels buffer needs to be resized, the sound(4) driver checks that the buffer is not memory-mapped and then drops the channel lock to allocate a new buffer. An mmap(2) call on another thread can complete during this window, after which the resize path frees the now-mapped buffer without rechecking.
An unprivileged local user with access to a sound device can exploit this race to trigger a use-after-free in the kernel, potentially escalating privileges.
Weakness
The product checks the state of a resource before using that resource, but the resource’s state can change between the check and the use in a way that invalidates the results of the check.
Affected Software
| Name | Vendor | Start Version | End Version |
|---|---|---|---|
| Freebsd | Freebsd | 14.4 (including) | 14.4 (including) |
| Freebsd | Freebsd | 14.4-p1 (including) | 14.4-p1 (including) |
| Freebsd | Freebsd | 14.4-p10 (including) | 14.4-p10 (including) |
| Freebsd | Freebsd | 14.4-p2 (including) | 14.4-p2 (including) |
| Freebsd | Freebsd | 14.4-p3 (including) | 14.4-p3 (including) |
| Freebsd | Freebsd | 14.4-p4 (including) | 14.4-p4 (including) |
| Freebsd | Freebsd | 14.4-p5 (including) | 14.4-p5 (including) |
| Freebsd | Freebsd | 14.4-p6 (including) | 14.4-p6 (including) |
| Freebsd | Freebsd | 14.4-p7 (including) | 14.4-p7 (including) |
| Freebsd | Freebsd | 14.4-p8 (including) | 14.4-p8 (including) |
| Freebsd | Freebsd | 14.4-p9 (including) | 14.4-p9 (including) |
| Freebsd | Freebsd | 14.5 (including) | 14.5 (including) |
| Freebsd | Freebsd | 14.5-p1 (including) | 14.5-p1 (including) |
| Freebsd | Freebsd | 15.1 (including) | 15.1 (including) |
| Freebsd | Freebsd | 15.1-p1 (including) | 15.1-p1 (including) |
| Freebsd | Freebsd | 15.1-p2 (including) | 15.1-p2 (including) |
| Freebsd | Freebsd | 15.1-p3 (including) | 15.1-p3 (including) |
| Freebsd | Freebsd | 15.1-p4 (including) | 15.1-p4 (including) |