Description
In the Linux kernel, the following vulnerability has been resolved: soundwire: fix bug in sdw_add_element_group_count found by syzkaller The original implementation caused an out-of-bounds memory access in the sdw_add_element_group_count for-loop when i == num. for (i = 0; i <= num; i++) { if (rate == group->rates[i] && lane == group->lanes[i]) ... To fix this error, the function now checks for existing rate/lane entries in the group(a function parameter) using a for-loop before adding them. No functional changes apart from this fix.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
9026118f20e28f202dab34f219bbb831ffb8c4dc to < c35474cf6a7d0891ebebbeda08ce34b602885ab6affected9026118f20e28f202dab34f219bbb831ffb8c4dc to < a2275dce05e6d1cce69bf68f23ea7a63c0c54baeaffected9026118f20e28f202dab34f219bbb831ffb8c4dc to < 5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5affected9026118f20e28f202dab34f219bbb831ffb8c4dc to < a454f61747c97e2eadaa7a35ffc1f4b1645c6a53affected9026118f20e28f202dab34f219bbb831ffb8c4dc to < e483a406a23a92d5202e8d324f206e127eef48ffaffected9026118f20e28f202dab34f219bbb831ffb8c4dc to < f772ff5a0e6758fd412803c09e03ba3bca5f5878affected
Linux Linux
Default version status: affected
5.10affected0 to < 5.10unaffected6.1.191 to ≤ 6.1.*unaffected6.6.160 to ≤ 6.6.*unaffected6.12.114 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c35474cf6a7d0891ebebbeda08ce34b602885ab6 ↗
- https://git.kernel.org/stable/c/a2275dce05e6d1cce69bf68f23ea7a63c0c54bae ↗
- https://git.kernel.org/stable/c/5c3ce6d3559ce57e6c3108aa9ecf7b32764188c5 ↗
- https://git.kernel.org/stable/c/a454f61747c97e2eadaa7a35ffc1f4b1645c6a53 ↗
- https://git.kernel.org/stable/c/e483a406a23a92d5202e8d324f206e127eef48ff ↗
- https://git.kernel.org/stable/c/f772ff5a0e6758fd412803c09e03ba3bca5f5878 ↗