In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: 6fire: fix OOB write from device-reported iso length<\/p>\n
usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as
\n(actual_length – 4) \/ (in_n_analog << 2) * (out_n_analog << 2) + 4, where
\nactual_length is the unsigned length the device reported for the matching
\nIN packet. A packet completed with status 0 and actual_length buffer, a 4832-byte object from
\nkcalloc(PCM_MAX_PACKET_SIZE, PCM_N_PACKETS_PER_URB).<\/p>\n
Even without the wrap the result is out of bounds: at 88.2\/96 kHz the
\n4-in\/6-out scaling turns a full 420-byte IN packet into 628, so eight
\npackets span 5024 bytes of that buffer. usb_submit_urb() rejects an
\nover-long descriptor only after the memset() and the
\nusb6fire_pcm_playback() copy of user PCM data have run.<\/p>\n
Guard the subtraction as the sibling usb6fire_pcm_capture() already does,
\nand limit the frame count to what fits in rt->out_packet_size, the OUT
\nendpoint’s wMaxPacketSize. This bounds total_length by the buffer size
\nwhile keeping each packet length aligned to a whole output frame.<\/p>\n
BUG: KASAN: out-of-bounds in usb6fire_pcm_in_urb_handler (sound\/usb\/6fire\/pcm.c:338)
\n Write of size 18446744073709551456 at addr ffff88802a3d0000 by task vhci_rx\/5018
\n Call Trace:
\n dump_stack_lvl (lib\/dump_stack.c:94 lib\/dump_stack.c:120)
\n print_report (mm\/kasan\/report.c:378 mm\/kasan\/report.c:482)
\n kasan_report (mm\/kasan\/report.c:595)
\n kasan_check_range (mm\/kasan\/generic.c:186 mm\/kasan\/generic.c:200)
\n __asan_memset (mm\/kasan\/shadow.c:84)
\n usb6fire_pcm_in_urb_handler (sound\/usb\/6fire\/pcm.c:338)
\n __usb_hcd_giveback_urb (drivers\/usb\/core\/hcd.c:1657)
\n usb_hcd_giveback_urb (drivers\/usb\/core\/hcd.c:1741)
\n vhci_rx_loop (drivers\/usb\/usbip\/vhci_rx.c:107 drivers\/usb\/usbip\/vhci_rx.c:242)
\n kthread (kernel\/kthread.c:436)
\n ret_from_fork (arch\/x86\/kernel\/process.c:158)
\n ret_from_fork_asm (arch\/x86\/entry\/entry_64.S:245)<\/p>\n
Allocated by task 10:
\n __kmalloc_cache_noprof (mm\/slub.c:5563)
\n usb6fire_pcm_init (sound\/usb\/6fire\/pcm.c:560 sound\/usb\/6fire\/pcm.c:595)
\n usb6fire_chip_probe (sound\/usb\/6fire\/chip.c:133)
\n usb_probe_interface (drivers\/usb\/core\/driver.c:399)<\/p>\n
The buggy address belongs to the object at ffff88802a3d0000
\n which belongs to the cache kmalloc-8k of size 8192
\n The buggy address is located 0 bytes inside of
\n 4832-byte region [ffff88802a3d0000, ffff88802a3d12e0)
\n Kernel panic – not syncing: Fatal exception in interrupt<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: 6fire: fix OOB write from device-reported iso length<\/p>\n
usb6fire_pcm_in_urb_handler() sizes each outgoing isochronous packet as<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-33381","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/33381","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=33381"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=33381"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=33381"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}