In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: ua101: reject mismatched capture\/playback packet sizes<\/p>\n
detect_usb_format() cross-checks bSubframeSize, bBitResolution and
\ntSamFreq between the capture and playback interfaces, but never relates
\nthe two endpoints’ wMaxPacketSize and bNrChannels. Each playback URB
\ngets a buffer of ua->playback.max_packet_bytes, while the number of
\nbytes written into it is derived from the capture stream:
\ncapture_urb_complete() computes frames from the received capture packet
\nand capture.frame_bytes, and start_usb_playback() and playback_work()
\nmultiply that by playback.frame_bytes.<\/p>\n
A device declaring a large capture wMaxPacketSize with few capture
\nchannels and a small playback wMaxPacketSize with many playback channels
\ntherefore memset()s and memcpy()s past the end of the playback buffer,
\nin open() of the PCM node the driver registers during probe.
\nusb_submit_urb() rejects the over-long iso_frame_desc[0].length with
\n-EMSGSIZE, but only after the write.<\/p>\n
Reject such descriptors at probe time. Genuine UA-101\/UA-1000 hardware
\ndeclares proportional packet sizes and is unaffected.<\/p>\n
BUG: KASAN: slab-out-of-bounds in start_usb_playback (sound\/usb\/misc\/ua101.c:586)
\n Write of size 2048 at addr ffff8881098f3c00 by task exploit\/5021
\n Call Trace:
\n __asan_memset (mm\/kasan\/shadow.c:84)
\n start_usb_playback (sound\/usb\/misc\/ua101.c:586)
\n playback_pcm_open (sound\/usb\/misc\/ua101.c:679)
\n snd_pcm_open_substream (sound\/core\/pcm_native.c:2829)
\n snd_pcm_open (sound\/core\/pcm_native.c:2865 sound\/core\/pcm_native.c:2932)
\n snd_pcm_playback_open (sound\/core\/pcm_native.c:2891)
\n snd_open (sound\/core\/sound.c:166)
\n chrdev_open (fs\/char_dev.c:411)
\n do_dentry_open (fs\/open.c:996)
\n vfs_open (fs\/open.c:1101)
\n path_openat (fs\/namei.c:4837 fs\/namei.c:5000)
\n do_file_open (fs\/namei.c:5029)
\n do_sys_openat2 (fs\/open.c:1417)
\n __x64_sys_openat (fs\/open.c:1423 fs\/open.c:1439 fs\/open.c:1434)
\n do_syscall_64 (arch\/x86\/entry\/syscall_64.c:61 arch\/x86\/entry\/syscall_64.c:84)
\n entry_SYSCALL_64_after_hwframe (arch\/x86\/entry\/entry_64.S:121)<\/p>\n
The buggy address belongs to the object at ffff8881098f3c00
\n which belongs to the cache kmalloc-192 of size 192
\n The buggy address is located 0 bytes inside of
\n allocated 168-byte region [ffff8881098f3c00, ffff8881098f3ca8)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: ua101: reject mismatched capture\/playback packet sizes<\/p>\n
detect_usb_format() cross-checks bSubframeSize, bBitResolution and
\ntS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41213","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41213","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41213"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41213"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41213"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}