Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: caiaq: validate EP1 reply lengths usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then reads command-specific fixed items from the same URB buffer. Several paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that urb->actual_length contains those bytes. Add per-command length checks, use a payload length derived from the bytes after the command byte for the control-state copy, and reject short analog input payloads before the input helper reads fixed offsets from the EP1 reply.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < 91acd231f219452fa58285239f83945accad9513affected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < 7cc6b3745a0cea697c8d0684b3094f220281a08daffected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < add9328c91c195c494cd68a21b19e5e47a20d784affected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < 319393151367e6626affedcdd4f7b7b0286f4246affected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < af8a172c4f71ac30d625f2966d2389a7fa872819affected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < 74f3c639f64fa5da4e1613149798b5089bce2807affected523f1dce37434a9a6623bf46e7893e2b4b10ac3c to < aba30af07d4fe499b50209801eba9da8a815522faffected
Linux Linux
Default version status: affected
2.6.22affected0 to < 2.6.22unaffected5.10.271 to ≤ 5.10.*unaffected5.15.222 to ≤ 5.15.*unaffected6.1.189 to ≤ 6.1.*unaffected6.6.158 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/91acd231f219452fa58285239f83945accad9513 ↗
- https://git.kernel.org/stable/c/7cc6b3745a0cea697c8d0684b3094f220281a08d ↗
- https://git.kernel.org/stable/c/add9328c91c195c494cd68a21b19e5e47a20d784 ↗
- https://git.kernel.org/stable/c/319393151367e6626affedcdd4f7b7b0286f4246 ↗
- https://git.kernel.org/stable/c/af8a172c4f71ac30d625f2966d2389a7fa872819 ↗
- https://git.kernel.org/stable/c/74f3c639f64fa5da4e1613149798b5089bce2807 ↗
- https://git.kernel.org/stable/c/aba30af07d4fe499b50209801eba9da8a815522f ↗