In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()<\/p>\n
snd_usbmidi_novation_output() lays out a two-byte header at
\ntransfer_buffer[0..1] and passes &transfer_buffer[2] together with a
\nlength of ep->max_transfer – 2 to snd_rawmidi_transmit():<\/p>\n
\tcount = snd_rawmidi_transmit(ep->ports[0].substream,
\n\t\t\t\t &transfer_buffer[2],
\n\t\t\t\t ep->max_transfer – 2);<\/p>\n
ep->max_transfer comes from the output endpoint’s wMaxPacketSize via
\nusb_maxpacket(). A malformed or malicious device can advertise a bulk
\nOUT endpoint with a wMaxPacketSize of 1 – the USB core only clamps this
\nvalue downwards – so ep->max_transfer becomes 1 and the count argument
\nbecomes -1.<\/p>\n
snd_rawmidi_transmit() passes the negative count on to
\n__snd_rawmidi_transmit_peek(), where “if (count1 > count) count1 = count”
\nleaves count1 negative; get_aligned_size() keeps it negative for a
\nbyte-stream substream, so the following memcpy(buffer, …, count1) runs
\nwith a (size_t)-1 length and writes far past the transfer buffer, which
\nwas allocated with usb_alloc_coherent(ep->max_transfer).<\/p>\n
This is the same class of bug that was fixed for snd_usbmidi_akai_output()
\nin commit 0970274613fb (“ALSA: usb-audio: fix OOB write in
\nsnd_usbmidi_akai_output()”); the novation output routine was left
\nunguarded. Bail out when the endpoint cannot hold the two-byte header
\nplus at least one payload byte.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usb-audio: fix OOB write in snd_usbmidi_novation_output()<\/p>\n
snd_usbmidi_novation_output() lays out a two-byte header at
\ntransf<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-17333","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/17333","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=17333"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=17333"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=17333"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}