Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Clamp frame size in implicit-feedback mode snd_usb_handle_sync_urb() scales received sync packet sizes by the sender's stride and stores the result directly in out_packet->packet_size[i]. If a connected USB device sends an oversized sync packet, this frame count can exceed ep->maxframesize. The un-clamped frame count then propagates to the playback endpoint queue, potentially driving packet transfers beyond the endpoint's hardware frame limits. Cap the calculated frame count against ep->maxframesize in snd_usb_handle_sync_urb() to prevent oversized packets from entering the playback queue.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 2d39fea6d3c19a2f5811d123114d92e3d0115fd1affected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 09cf3dbbb4256a43feb91d2f51f274510a9ada47affected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7beaffected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 56ac3e7c90f6b45969c3fd07a98fad760ffd6901affected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < be97fea7451d758881b95af78e900dd0d58a382aaffected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 2db4535d6af79276a64449201c5be5feffb31c64affected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 53f0aa37eb945f3c983f61d12fc35eb33debb8a9affected28acb12014fb0c3e1edfdab1b1e3e266cf651550 to < 8d7a30c50c2e58a6839634ed0acde14466d1dc61affected
Linux Linux
Default version status: affected
3.8affected0 to < 3.8unaffected5.10.265 to ≤ 5.10.*unaffected5.15.216 to ≤ 5.15.*unaffected6.1.183 to ≤ 6.1.*unaffected6.6.151 to ≤ 6.6.*unaffected6.12.103 to ≤ 6.12.*unaffected6.18.44 to ≤ 6.18.*unaffected7.1.8 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/2d39fea6d3c19a2f5811d123114d92e3d0115fd1 ↗
- https://git.kernel.org/stable/c/09cf3dbbb4256a43feb91d2f51f274510a9ada47 ↗
- https://git.kernel.org/stable/c/cfa8d3e0e8b812c4db4d5241f62b6bdbab2bd7be ↗
- https://git.kernel.org/stable/c/56ac3e7c90f6b45969c3fd07a98fad760ffd6901 ↗
- https://git.kernel.org/stable/c/be97fea7451d758881b95af78e900dd0d58a382a ↗
- https://git.kernel.org/stable/c/2db4535d6af79276a64449201c5be5feffb31c64 ↗
- https://git.kernel.org/stable/c/53f0aa37eb945f3c983f61d12fc35eb33debb8a9 ↗
- https://git.kernel.org/stable/c/8d7a30c50c2e58a6839634ed0acde14466d1dc61 ↗