CVE-2021-47509

What it actually does

The flaw permits an OSS PCM period size up to 2^31 bytes, causing ALSA to allocate correspondingly large temporary buffers and exhaust kernel memory.

Why it matters to the business

Audio-related processes or entire systems may become unresponsive or crash when an untrusted local user triggers the oversized allocation, leading to unplanned downtime for any workloads that rely on ALSA OSS emulation.

How an attack unfolds

A local attacker opens an OSS PCM device, issues an ioctl to set an excessively large fragment shift, then performs a read or write that forces allocation of the oversized temporary buffer, exhausting memory and triggering the OOM killer.

How to fix it

Apply the upstream commit that caps OSS period size at 16 MB; rebuild and boot the patched kernel, or upgrade to any distribution kernel that already contains the fix.

How to confirm the fix worked

Confirm the kernel source contains the 16 MB limit check in sound/core/oss/pcm_oss.c; test by attempting to set a larger period size and verifying the ioctl now fails or is clamped.

Typical attack path

1. Obtain local user access on a Linux system with ALSA OSS emulation enabled
2. Open /dev/dsp or equivalent OSS device node
3. Issue SNDCTL_DSP_SETFRAGMENT ioctl with a fragment shift yielding >16 MB period size
4. Perform a subsequent read/write operation that allocates the period buffer
5. Observe system-wide memory pressure or process termination

How to detect it

Review kernel logs for OOM killer invocations immediately after OSS PCM open or ioctl activity; correlate with processes that have recently accessed OSS device nodes.

What your security team should do

• Prioritize kernel updates on any multi-tenant or user-facing Linux systems that expose OSS device nodes
• Restrict unprivileged access to /dev/dsp* nodes via device ACLs or container policies where feasible
• Monitor for unusual OOM events on systems running audio workloads