Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: control: Validate buf_len before strnlen() in snd_ctl_elem_init_enum_names() snd_ctl_elem_init_enum_names() advances pointer p through the names buffer while decrementing buf_len. If buf_len reaches zero but items remain, the next iteration calls strnlen(p, 0). While strnlen(p, 0) returns 0 and would hit the existing name_len == 0 error path, CONFIG_FORTIFY_SOURCE's fortified strnlen() first checks maxlen against __builtin_dynamic_object_size(). When Clang loses track of p's object size inside the loop, this triggers a BRK exception panic before the return value is examined. Add a buf_len == 0 guard at the loop entry to prevent calling fortified strnlen() on an exhausted buffer. Found by kernel fuzz testing through Xiaomi Smartphone.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < 708f6ec9bcdf58bfd561409110baaf4fd3be4ea3affected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < bfcbb4994da9e979c4bcfcf24aaaac69e457e48eaffected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < a470f7cabc4df72d9bd132f5719a8717292bb440affected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < 1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0affected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < 8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9eaffected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < 654c818a69c21d2bea4e8fd9eae7da865df9a5c8affected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < 82012fd3e78a14360fbc2f1a7491589896704f97affected8d448162bda5ae3b5ecb26fe50c8fbbeae99faa4 to < e0da8a8cac74f4b9f577979d131f0d2b88a84487affected
Linux Linux
Default version status: affected
3.2affected0 to < 3.2unaffected5.10.258 to ≤ 5.10.*unaffected5.15.209 to ≤ 5.15.*unaffected6.1.175 to ≤ 6.1.*unaffected6.6.140 to ≤ 6.6.*unaffected6.12.86 to ≤ 6.12.*unaffected6.18.27 to ≤ 6.18.*unaffected7.0.4 to ≤ 7.0.*unaffected7.1 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/708f6ec9bcdf58bfd561409110baaf4fd3be4ea3 ↗
- https://git.kernel.org/stable/c/bfcbb4994da9e979c4bcfcf24aaaac69e457e48e ↗
- https://git.kernel.org/stable/c/a470f7cabc4df72d9bd132f5719a8717292bb440 ↗
- https://git.kernel.org/stable/c/1fbe46d2b72754d8bd580e13e59ccb5d3d0e8cb0 ↗
- https://git.kernel.org/stable/c/8ba0214c3dd32b8ec652947e3f2bc5b8f6e6be9e ↗
- https://git.kernel.org/stable/c/654c818a69c21d2bea4e8fd9eae7da865df9a5c8 ↗
- https://git.kernel.org/stable/c/82012fd3e78a14360fbc2f1a7491589896704f97 ↗
- https://git.kernel.org/stable/c/e0da8a8cac74f4b9f577979d131f0d2b88a84487 ↗
- https://cert-portal.siemens.com/productcert/html/ssa-784472.html ↗