Description
In the Linux kernel, the following vulnerability has been resolved: greybus: audio: bound the topology section sizes against the fetched size gb_audio_gb_get_topology() fetches a topology blob of a module-supplied size, and gbaudio_tplg_parse_data() then walks it by adding the module-supplied size_dais, size_controls and size_widgets fields to form the control, widget and route section offsets. Those le32 sizes are never checked against the fetched blob, so a module reporting a small topology size but large section sizes makes the offsets point past the allocation, and parsing reads out of bounds. Reject a topology whose section sizes do not fit within the fetched size before it is parsed.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
184992e305f1de3a3d5fa446da3a2bc76be7c54a to < ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43eaffected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < dd5593aee0a0fb353e1164aff7b65e563fe1f232affected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < 6f764363b3173d805be11e59a8f23ecee2d420d5affected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < 52daf9de692ebac813d110eb1e677dc0e1f4a5abaffected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < d0f6eaba60705bacd9bb4ce48eab50ef3f546777affected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < c9191f2e2f35f1209eb2dc24b31129dd47b48c16affected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < cfcc5a41a9664eb68023aae4cd0d485b256bd7c7affected184992e305f1de3a3d5fa446da3a2bc76be7c54a to < 33d8c7b794d2a30637c9d3fcb478f1d3222bef1eaffected
Linux Linux
Default version status: affected
4.9affected0 to < 4.9unaffected5.10.270 to ≤ 5.10.*unaffected5.15.221 to ≤ 5.15.*unaffected6.1.188 to ≤ 6.1.*unaffected6.6.157 to ≤ 6.6.*unaffected6.12.110 to ≤ 6.12.*unaffected6.18.52 to ≤ 6.18.*unaffected7.2.6 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/ba86de9f7b0d7903d2df5ea2373e34d8ca3fc43e ↗
- https://git.kernel.org/stable/c/dd5593aee0a0fb353e1164aff7b65e563fe1f232 ↗
- https://git.kernel.org/stable/c/6f764363b3173d805be11e59a8f23ecee2d420d5 ↗
- https://git.kernel.org/stable/c/52daf9de692ebac813d110eb1e677dc0e1f4a5ab ↗
- https://git.kernel.org/stable/c/d0f6eaba60705bacd9bb4ce48eab50ef3f546777 ↗
- https://git.kernel.org/stable/c/c9191f2e2f35f1209eb2dc24b31129dd47b48c16 ↗
- https://git.kernel.org/stable/c/cfcc5a41a9664eb68023aae4cd0d485b256bd7c7 ↗
- https://git.kernel.org/stable/c/33d8c7b794d2a30637c9d3fcb478f1d3222bef1e ↗