In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf<\/p>\n
The in04_last array in struct usx2ydev is declared as char[24], but
\nin04_buf is allocated as sizeof(struct us428_ctls) which is 21 bytes.
\nIn i_usx2y_in04_int(), when ctl_snapshot_last == -2 (initialization
\npath):<\/p>\n
memcpy(usx2y->in04_last, usx2y->in04_buf, sizeof(usx2y->in04_last));<\/p>\n
This copies 24 bytes from a 21-byte slab allocation, reading 3 bytes
\npast the end of the source object.<\/p>\n
Introduce a USX2Y_IN04_SIZE constant defined as sizeof(struct
\nus428_ctls) and use it consistently for the in04_last array, the
\nin04_buf allocation, the URB transfer length, and the comparison loop,
\nreplacing the bare 24 and 21 literals throughout.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: usbusx2y: fix in04_last array size mismatch with in04_buf<\/p>\n
The in04_last array in struct usx2ydev is declared as char[24], bu<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29086","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29086","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29086"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29086"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29086"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}