Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usbusx2y: validate URB actual_length in interrupt callback i_usx2y_in04_int() processes the interrupt URB data without checking urb->actual_length. A short transfer from a malfunctioning device would cause the handler to process uninitialized heap data from the kmalloc-allocated in04_buf, which is then copied to the mmap-accessible ctl_snapshot[] array. Fix by using kzalloc() for in04_buf to zero-initialize the buffer, and adding an actual_length check to skip processing on short transfers while still resubmitting the URB.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c3576cb77b527f223cf2b9fc2b2e9af5e7adee25affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c156584999bf15118f523ef6c6fedc5b21f46bd9affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7daffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 2770321b358658e0a39fe39ccf6a91ee97a81931affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8f5ef203abda9dd36b2af473c7b737d544f807bdaffected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected6.6.160 to ≤ 6.6.*unaffected6.12.111 to ≤ 6.12.*unaffected6.18.53 to ≤ 6.18.*unaffected7.2.7 to ≤ 7.2.*unaffected7.3 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/c3576cb77b527f223cf2b9fc2b2e9af5e7adee25 ↗
- https://git.kernel.org/stable/c/c156584999bf15118f523ef6c6fedc5b21f46bd9 ↗
- https://git.kernel.org/stable/c/b0c30fe6c0d5902bd8a7d1d5720bead5bbe46f7d ↗
- https://git.kernel.org/stable/c/2770321b358658e0a39fe39ccf6a91ee97a81931 ↗
- https://git.kernel.org/stable/c/8f5ef203abda9dd36b2af473c7b737d544f807bd ↗