Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: caiaq: fix stack out-of-bounds read in init_card The loop creates a whitespace-stripped copy of the card shortname where `len < sizeof(card->id)` is used for the bounds check. Since sizeof(card->id) is 16 and the local id buffer is also 16 bytes, writing 16 non-space characters fills the entire buffer, overwriting the terminating nullbyte. When this non-null-terminated string is later passed to snd_card_set_id() -> copy_valid_id_string(), the function scans forward with `while (*nid && ...)` and reads past the end of the stack buffer, reading the contents of the stack. A USB device with a product name containing many non-ASCII, non-space characters (e.g. multibyte UTF-8) will reliably trigger this as follows: BUG: KASAN: stack-out-of-bounds in copy_valid_id_string sound/core/init.c:696 [inline] BUG: KASAN: stack-out-of-bounds in snd_card_set_id_no_lock+0x698/0x74c sound/core/init.c:718 The off-by-one has been present since commit bafeee5b1f8d ("ALSA: snd_usb_caiaq: give better shortname") from June 2009 (v2.6.31-rc1), which first introduced this whitespace-stripping loop. The original code never accounted for the null terminator when bounding the copy. Fix this by changing the loop bound to `sizeof(card->id) - 1`, ensuring at least one byte remains as the null terminator.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
bafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 02d9c5b0b5553a391448b6d655262bd829f90234affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 66194c2575a4f567577ae70b1d7561163ce791a6affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < a82c1bce2d1299dd3c686a8fe48cf75b79a403c7affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 3178b62e2e31bab39f63d4c8e54bf4ee0a425627affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 3afa2e67f3523a980a2f90fd63c22322ac2b9ce0affectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 7594a6464873d90fd229e5b94cdd3b92c9feabedaffectedbafeee5b1f8d32cbf791c322b40a6fa91d8ccf7a to < 45424e871abf2a152e247a9cff78359f18dd95c0affected
Linux Linux
Default version status: affected
2.6.31affected0 to < 2.6.31unaffected5.10.253 to ≤ 5.10.*unaffected5.15.203 to ≤ 5.15.*unaffected6.1.168 to ≤ 6.1.*unaffected6.6.134 to ≤ 6.6.*unaffected6.12.81 to ≤ 6.12.*unaffected6.18.22 to ≤ 6.18.*unaffected6.19.12 to ≤ 6.19.*unaffected7.0 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/02d9c5b0b5553a391448b6d655262bd829f90234 ↗
- https://git.kernel.org/stable/c/3f7f8bae0d52cbd07ab04b76b6aac89ef98ee9f6 ↗
- https://git.kernel.org/stable/c/66194c2575a4f567577ae70b1d7561163ce791a6 ↗
- https://git.kernel.org/stable/c/a82c1bce2d1299dd3c686a8fe48cf75b79a403c7 ↗
- https://git.kernel.org/stable/c/3178b62e2e31bab39f63d4c8e54bf4ee0a425627 ↗
- https://git.kernel.org/stable/c/3afa2e67f3523a980a2f90fd63c22322ac2b9ce0 ↗
- https://git.kernel.org/stable/c/7594a6464873d90fd229e5b94cdd3b92c9feabed ↗
- https://git.kernel.org/stable/c/45424e871abf2a152e247a9cff78359f18dd95c0 ↗