Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: ctxfi: Fix potential OOB access in audio mixer handling In the audio mixer handling code of ctxfi driver, the conf field is used as a kind of loop index, and it's referred in the index callbacks (amixer_index() and sum_index()). As spotted recently by fuzzers, the current code causes OOB access at those functions. | UBSAN: array-index-out-of-bounds in /build/reproducible-path/linux-6.17.8/sound/pci/ctxfi/ctamixer.c:347:48 | index 8 is out of range for type 'unsigned char [8]' After the analysis, the cause was found to be the lack of the proper (re-)initialization of conj field. This patch addresses those OOB accesses by adding the proper initializations of the loop indices.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8cc72361481f00253f1e468ade5795427386d593 to < 6524205326e0c1a21263b5c14e48e14ef7e449aeaffected8cc72361481f00253f1e468ade5795427386d593 to < afca7ff5d5d4d63a1acb95461f55ca9a729feedfaffected8cc72361481f00253f1e468ade5795427386d593 to < 8c1d09806e1441bc6a54b9a4f2818918046d5174affected8cc72361481f00253f1e468ade5795427386d593 to < a8c42d11b0526a89192bd2f79facb4c60c8a1f38affected8cc72361481f00253f1e468ade5795427386d593 to < d77ba72558cd66704f0fb7e0969f697e87c0f71caffected8cc72361481f00253f1e468ade5795427386d593 to < 873e2360d247eeee642878fcc3398babff7e387caffected8cc72361481f00253f1e468ade5795427386d593 to < 61006c540cbdedea83b05577dc7fb7fa18fe1276affected
Linux Linux
Default version status: affected
2.6.31affected0 to < 2.6.31unaffected5.10.249 to ≤ 5.10.*unaffected5.15.199 to ≤ 5.15.*unaffected6.1.162 to ≤ 6.1.*unaffected6.6.122 to ≤ 6.6.*unaffected6.12.68 to ≤ 6.12.*unaffected6.18.8 to ≤ 6.18.*unaffected6.19 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/6524205326e0c1a21263b5c14e48e14ef7e449ae ↗
- https://git.kernel.org/stable/c/afca7ff5d5d4d63a1acb95461f55ca9a729feedf ↗
- https://git.kernel.org/stable/c/8c1d09806e1441bc6a54b9a4f2818918046d5174 ↗
- https://git.kernel.org/stable/c/a8c42d11b0526a89192bd2f79facb4c60c8a1f38 ↗
- https://git.kernel.org/stable/c/d77ba72558cd66704f0fb7e0969f697e87c0f71c ↗
- https://git.kernel.org/stable/c/873e2360d247eeee642878fcc3398babff7e387c ↗
- https://git.kernel.org/stable/c/61006c540cbdedea83b05577dc7fb7fa18fe1276 ↗