In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()<\/p>\n
fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size
\nby the driver’s own limit of 255<\/p>\n
\tif (map.map_size 255 ||
\n\t map.meter_slots 255)
\n\t\treturn -EINVAL;<\/p>\n
and passes it to fcp_add_new_ctl() as the control’s channel count, where
\nit is stored as elem->channels.<\/p>\n
Every control read writes into struct snd_ctl_elem_value, whose integer
\narray is declared long value[128], so the limit is 128, not 255.
\nfcp_meter_ctl_get() stores one 64-bit word per channel into that array
\nwith no bound of its own:<\/p>\n
\tfor (i = 0; i channels; i++) {
\n\t\tint idx = private->meter_level_map[i];
\n\t\tint value = idx value.integer.value[i] = value;
\n\t}<\/p>\n
snd_ctl_elem_read_user() serves that object from
\nmemdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of
\nkmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so
\nelement i is written at byte 72 + 8 * i and element 144 already lands
\npast the allocation. At map_size 255 the last store ends at byte 2112,
\n888 bytes past the object and 64 bytes into the adjacent slab object.
\nThe stored words come from the device and meter_level_map[] selects
\nwhich word lands in which slot, so extent and contents are both
\ncontrolled.<\/p>\n
The core does not catch this. snd_ctl_check_elem_info() is reached only
\nfrom __snd_ctl_elem_info(), which snd_ctl_elem_read() calls under
\nCONFIG_SND_CTL_DEBUG; without that option snd_ctl_skip_validation() is a
\ncompile-time true. __snd_ctl_add_replace() validates kcontrol->count and
\nnever inspects elem->channels.<\/p>\n
Installing an oversized map needs CAP_SYS_RAWIO, but the control outlives
\nthe hwdep descriptor that created it, so the out-of-bounds stores are
\nissued by any process able to read controls on \/dev\/snd\/controlC0.<\/p>\n
KASAN on 7.2.0-rc5 (arm64), triggered by an unprivileged control read:<\/p>\n
BUG: KASAN: slab-out-of-bounds in fcp_meter_ctl_get
\n Write of size 8 at addr ffff000017af04c8 by task fcp_trigger\/185
\n __asan_store8
\n fcp_meter_ctl_get
\n snd_ctl_elem_read
\n snd_ctl_ioctl
\n Allocated by task 185:
\n memdup_user
\n snd_ctl_ioctl
\n The buggy address is located 0 bytes to the right of
\n allocated 1224-byte region [ffff000017af0000, ffff000017af04c8)<\/p>\n
Bound the map size by the ABI limit rather than by 255, and bound the
\nstore loop at the sink so it cannot run past the value array whatever
\nelem->channels holds.<\/p>\n
Discovered by XBOW, triaged by Baul Lee <\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: FCP: fix OOB write in fcp_meter_ctl_get()<\/p>\n
fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size
\nby the dri<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-11237","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/11237","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=11237"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=11237"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=11237"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}