CVE-2021-47096

What it actually does

The vulnerability leaves the user_pversion field uninitialized in the ALSA rawmidi file structure allocated via kmalloc, potentially exposing kernel memory contents to user space.

Why it matters to the business

Attackers may obtain sensitive kernel data, increasing risk of further exploitation or data leaks in systems using ALSA audio interfaces.

How an attack unfolds

An attacker with access to open ALSA rawmidi devices can trigger the open function to read the uninitialized user_pversion value, disclosing kernel memory.

How to fix it

Apply the kernel patch that initializes user_pversion in the rawmidi open function.

How to confirm the fix worked

Verify the source code change in sound/core/rawmidi.c or equivalent to ensure initialization occurs before use.

Typical attack path

1. Identify systems with ALSA rawmidi support
2. Open the rawmidi device file
3. Read or trigger operations that expose the uninitialized field

How to detect it

Examine kernel logs for unusual rawmidi access patterns or memory-related warnings; no specific post-exploitation artifacts are known.

What your security team should do

• Update to a kernel version containing the fix
• Restrict access to rawmidi devices if possible
• Monitor for kernel updates