In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ASoC: dapm: Fix off-by-one check on the second enum channel<\/p>\n
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches
\ne->items, but it lets item[1] be equal to it. Both go on to
\nsnd_soc_enum_item_to_val(), which indexes e->values with no bound of
\nits own, so an enum with a value table reads one element past the end.<\/p>\n
The indexing arrived with the MUX consolidation, which relaxed the
\nitem[1] check in the same hunk. The value MUX handler it deleted used
\n>= there, and the snd_soc_put_enum_double() in soc-ops.c still does.<\/p>\n
Only adav80x pairs a value table with two shifts, and its second
\nchannel looks accidental, but the control does report two values.
\nWriting three into it reads off the end of adav80x_mux_values. The
\ncore catches that only under CONFIG_SND_CTL_INPUT_VALIDATION, which
\ndefaults off.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ASoC: dapm: Fix off-by-one check on the second enum channel<\/p>\n
The snd_soc_dapm_put_enum_double() rejects item[0] once it reaches
\ne-><\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-25477","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/25477","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=25477"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=25477"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=25477"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}