CVE-2018-10902

What it actually does

Concurrent access to raw MIDI devices in the kernel driver triggers a double-free condition in snd_rawmidi_input_params and snd_rawmidi_output_status during ioctl handling, resulting in a use-after-free that can be leveraged for arbitrary code execution with kernel privileges.

Why it matters to the business

Local attackers who already have a foothold on a Linux system can escalate to full root access, potentially compromising the entire host and any workloads or data it protects; the issue has been addressed in upstream kernels for nearly six years, so unpatched older distributions remain exposed.

How an attack unfolds

An attacker with local access opens a raw MIDI device, issues concurrent ioctl calls that race in snd_rawmidi_ioctl, triggers the double realloc, and uses the resulting use-after-free to corrupt kernel structures and execute code with elevated privileges.

How to fix it

Upgrade the Linux kernel to a version containing commit 39675f7a7c7e7702f7d5341f1e0d01db746543a0 or later; apply the corresponding security update from the distribution vendor for the running kernel series.

How to confirm the fix worked

Confirm the running kernel commit or package version includes 39675f7a7c7e7702f7d5341f1e0d01db746543a0; attempt to load the snd-rawmidi module and verify that concurrent ioctl calls no longer produce kernel warnings or crashes indicative of the double-free.

Typical attack path

1. Obtain local shell on target Linux system
2. Identify presence of raw MIDI device nodes or load the snd-rawmidi module
3. Craft and run a multithreaded program that opens the device and issues racing input/output parameter ioctls
4. Trigger double-free to obtain a controllable kernel pointer
5. Overwrite function pointers or credentials to gain root

How to detect it

Review kernel logs for repeated rawmidi ioctl warnings, use-after-free crashes, or auditd records of unusual access to raw MIDI device nodes; correlate with user sessions that suddenly gain root privileges without sudo logs.

What your security team should do

• Prioritize kernel updates on any systems still running kernels older than the 2018 fix commit
• Restrict local user access to /dev/snd/*rawmidi devices via udev rules or group membership where MIDI functionality is not required
• Monitor kernel update channels for backported fixes in LTS distributions