In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: line6: reject oversized playback packets<\/p>\n
Each playback URB is handed a slice of out.buffer that is exactly
\nLINE6_ISO_PACKETS * max_packet_size_out bytes, sized from the OUT
\nendpoint, but the number of bytes written into that slice is never
\ncompared against it.<\/p>\n
submit_audio_out_urb() takes the frame count from prev_fsize, which
\naudio_in_callback() derived from the *IN* endpoint’s received packet
\nlength, and rescales it with the playback frame size; when prev_fsize is
\nstill zero it synthesizes a length from the sample rate instead. On a
\ndevice declaring a large IN wMaxPacketSize and a small OUT
\nwMaxPacketSize, the resulting memcpy(), or the memset() when the
\nplayback stream is idle, runs past its slice and, as the reproducer
\nbelow shows, beyond the allocation.<\/p>\n
usb_submit_urb() is not a backstop. max_packet_size_out comes from
\nusb_maxpacket(), which returns only the low 11 bits of wMaxPacketSize,
\nwhile USB core validates a high-speed isochronous length against that
\nbase scaled by usb_endpoint_maxp_mult(). A length of up to three times
\nthe allocated slice is therefore accepted, and even a rejected URB is
\nonly rejected after the write.<\/p>\n
Reject a packet that does not fit the slice the driver allocated for it.
\nClamping it instead would silently shorten the capture-derived rate
\nfeedback and desynchronize the two streams.<\/p>\n
BUG: KASAN: slab-out-of-bounds in submit_audio_out_urb (sound\/usb\/line6\/playback.c:229)
\n Write of size 1024 at addr ffff888100bbd400 by task kworker\/1:2\/5002
\n Workqueue: events line6_startup_work
\n Call Trace:
\n __asan_memcpy (mm\/kasan\/shadow.c:106)
\n submit_audio_out_urb (sound\/usb\/line6\/playback.c:229)
\n line6_submit_audio_out_all_urbs (sound\/usb\/line6\/playback.c:291)
\n line6_stream_start (sound\/usb\/line6\/pcm.c:194)
\n line6_pcm_acquire (sound\/usb\/line6\/pcm.c:337)
\n line6_startup_work (sound\/usb\/line6\/driver.c:728)
\n process_one_work (kernel\/workqueue.c:3396)
\n worker_thread (kernel\/workqueue.c:3479 kernel\/workqueue.c:3560)
\n kthread (kernel\/kthread.c:436)
\n ret_from_fork (arch\/x86\/kernel\/process.c:158)
\n ret_from_fork_asm (arch\/x86\/entry\/entry_64.S:245)<\/p>\n
The buggy address belongs to the object at ffff888100bbd400
\n which belongs to the cache kmalloc-256 of size 256
\n The buggy address is located 0 bytes inside of
\n allocated 256-byte region [ffff888100bbd400, ffff888100bbd500)<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: line6: reject oversized playback packets<\/p>\n
Each playback URB is handed a slice of out.buffer that is exactly
\nLINE6_ISO_PACKETS<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-41308","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/41308","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=41308"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=41308"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=41308"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}