Description (CNA)
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix out-of-bounds read in snd_usb_get_audioformat_uac3() In snd_usb_get_audioformat_uac3(), the length value returned from snd_usb_ctl_msg() is used directly for memory allocation without validation. This length is controlled by the USB device. The allocated buffer is cast to a uac3_cluster_header_descriptor and its fields are accessed without verifying that the buffer is large enough. If the device returns a smaller than expected length, this leads to an out-of-bounds read. Add a length check to ensure the buffer is large enough for uac3_cluster_header_descriptor.
Affected (CNA)
| Vendor / product | Versions |
|---|---|
| Linux / Linux | affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 24ff7d465c4284529bbfa207757bffb6f44b6403; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 2dc1c3edf67abd30c757f8054a5da61927cdda21; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before c3fb926abe90d86f5e3055e0035f04d9892a118b; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 6eb211788e1370af52a245d4d7da35c374c7b401; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 74fcb3852a2f579151ce80b9ed96cd916ba0d5d8; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 0ee87c2814deb5e42921281116ac3abcb326880b; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before 11e740dc1a2c8590eb7074b5c4ab921bb6224c36; affected 9a2fe9b801f585baccf8352d82839dcd54b300cf before fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a |
| Linux / Linux | affected 4.17; unaffected 0 before 4.17; unaffected 5.4.296 through 5.4.*; unaffected 5.10.240 through 5.10.*; unaffected 5.15.187 through 5.15.*; unaffected 6.1.143 through 6.1.*; unaffected 6.6.96 through 6.6.*; unaffected 6.12.36 through 6.12.*; unaffected 6.15.5 through 6.15.*; unaffected 6.16 through * |
CWE
No CWE identifiers supplied.
References
- https://git.kernel.org/stable/c/24ff7d465c4284529bbfa207757bffb6f44b6403
- https://git.kernel.org/stable/c/2dc1c3edf67abd30c757f8054a5da61927cdda21
- https://git.kernel.org/stable/c/c3fb926abe90d86f5e3055e0035f04d9892a118b
- https://git.kernel.org/stable/c/6eb211788e1370af52a245d4d7da35c374c7b401
- https://git.kernel.org/stable/c/74fcb3852a2f579151ce80b9ed96cd916ba0d5d8
- https://git.kernel.org/stable/c/0ee87c2814deb5e42921281116ac3abcb326880b
- https://git.kernel.org/stable/c/11e740dc1a2c8590eb7074b5c4ab921bb6224c36
- https://git.kernel.org/stable/c/fb4e2a6e8f28a3c0ad382e363aeb9cd822007b8a
ADP enrichment
No English description supplied.