ASoC: tas2781: bound firmware description string parsing
- Published
- Last modified
- Where the record stands: published, rejected by its publisher, or superseded by another id.What do these mean? →
- published
- Whether CISA lists it in its Known Exploited Vulnerabilities catalog: proof that attackers are using it.What do these mean? →
- Not listed in CISA KEV
- Fix
- Fixed in 6.6.148, 6.12.101, 6.18.42, 7.1.6
- Whether working attack code is public (Exploit-DB, Metasploit, Nuclei or GitHub). Public code makes attacks easier.What do these mean? →
- None on Exploit-DB, Metasploit or GitHub
- Exploitation: none
- Automatable: no
- Technical impact: partial
Summary
In the Linux kernel, the following vulnerability has been resolved: ASoC: tas2781: bound firmware description string parsing The TAS2781 firmware parser reads several variable-length description strings with strlen() before checking that the string terminator is present inside the firmware blob. A malformed firmware image without a NUL terminator can therefore make the parser walk past the end of the firmware buffer before the later size checks run. Add a small bounded string-length helper and use it for all description fields that are parsed from the firmware buffer. Keep the existing size checks for the fixed bytes that follow each string.
Timeline
- CVE published
- CISA SSVC assessment
Exploitation: none · Automatable: no · Technical impact: partial
- Record last updated
Affected versions
- Linux Linux
From 915f5eadebd29ba185ac506766a90120153b7e14 · fixed in 3ddb0d3e36507615e5ef010a879357a54870adf5; From 915f5eadebd29ba185ac506766a90120153b7e14 · fixed in 0ec45e80a82785ee147516fdecf5c93707dec119; From 915f5eadebd29ba185ac506766a90120153b7e14 · fixed in 41ae2b7d37c3dd82302167496836cca9f0328374; From 915f5eadebd29ba185ac506766a90120153b7e14 · fixed in e75ef37d83c90b09bedb601624b47e168202b226; From 915f5eadebd29ba185ac506766a90120153b7e14 · fixed in bc889dfcea9294a1eae7f8e2f3573a90764ae4d0
- Linux Linux
6.5
- KernelLinux
From 6.5.0 · fixed in 6.6.148; From 6.7.0 · fixed in 6.12.101; From 6.13.0 · fixed in 6.18.42; From 6.19.0 · fixed in 7.1.6