From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id DC17F219A78 for ; Wed, 26 Feb 2025 02:15:44 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536144; cv=none; b=q14xeaOzsE7zAbqSumOmFwNQkttHkQMnxfeJvrUw0mdsuqXS9GtppEiySFi4mKcn0VbI86pDoddKrls+FgYu0Vc5+hZfd0ChYSXQnI78uZNiDdTTyQ0dYfkYXRyDoHxNv4zYcOZOfPybe+ftw/GVKANZ2Q4JO9nbLrBoQC2TrtE= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536144; c=relaxed/simple; bh=AFN9oPV5tEsb//UH0+JHAYg1P5IjRE6pUnBRB9pTn2k=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=A/cteF7baZbheE6BemZg+//Q8BKX+4IBqAfYOs8blGM/Q41hUE50g8GecVEt9M0czqP6Z0Faw6qsJYqSRNGLJ9R8YXpeYzRH2mSjKS8j89pBI7Rzyc9kclslvaCsYEQSlBYPDa1/CAVq+lSuMRCzptjKjp/rdAQCOeaMfy9b1Nw= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=sy2a7C/Y; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="sy2a7C/Y" Received: by smtp.kernel.org (Postfix) with ESMTPSA id B1C63C4CEDD; Wed, 26 Feb 2025 02:15:44 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536144; bh=AFN9oPV5tEsb//UH0+JHAYg1P5IjRE6pUnBRB9pTn2k=; h=From:To:Cc:Subject:Date:Reply-to:From; b=sy2a7C/YYj8Vop9YUNo+7Dl1Y/pIGzMw/nYLPTaYiDUqTap+aKHPtGRLxRyxmRztO QrVTSdhgCuE6fHuwZoYHKFcCsqirXO8CjfxCWDe21VYgzjBnlyBh++IHttjz9aHShu ygXErEdmeonhT7iud8eHhIM40+t7i4LQ3sFivfXA= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49515: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t Date: Wed, 26 Feb 2025 03:13:09 +0100 Message-ID: <2025022610-CVE-2022-49515-61ba@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=3162; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=AFN9oPV5tEsb//UH0+JHAYg1P5IjRE6pUnBRB9pTn2k=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7Kpjq/bNeTnNWWh13/a74TunP9708b/tq6E6c0HBVd t0UyQ2XO2JZGASZGGTFFFm+bOM5ur/ikKKXoe1pmDmsTCBDGLg4BWAinvsY5um1l7+e/sv95bJd Aptkfh6Vmmwo4Mgw36W7dtXMCpceXp3e3tDd9xnVp05tAwA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ASoC: cs35l41: Fix an out-of-bounds access in otp_packed_element_t The CS35L41_NUM_OTP_ELEM is 100, but only 99 entries are defined in the array otp_map_1/2[CS35L41_NUM_OTP_ELEM], this will trigger UBSAN to report a shift-out-of-bounds warning in the cs35l41_otp_unpack() since the last entry in the array will result in GENMASK(-1, 0). UBSAN reports this problem: UBSAN: shift-out-of-bounds in /home/hwang4/build/jammy/jammy/sound/soc/codecs/cs35l41-lib.c:836:8 shift exponent 64 is too large for 64-bit type 'long unsigned int' CPU: 10 PID: 595 Comm: systemd-udevd Not tainted 5.15.0-23-generic #23 Hardware name: LENOVO \x02MFG_IN_GO/\x02MFG_IN_GO, BIOS N3GET19W (1.00 ) 03/11/2022 Call Trace: show_stack+0x52/0x58 dump_stack_lvl+0x4a/0x5f dump_stack+0x10/0x12 ubsan_epilogue+0x9/0x45 __ubsan_handle_shift_out_of_bounds.cold+0x61/0xef ? regmap_unlock_mutex+0xe/0x10 cs35l41_otp_unpack.cold+0x1c6/0x2b2 [snd_soc_cs35l41_lib] cs35l41_hda_probe+0x24f/0x33a [snd_hda_scodec_cs35l41] cs35l41_hda_i2c_probe+0x65/0x90 [snd_hda_scodec_cs35l41_i2c] ? cs35l41_hda_i2c_remove+0x20/0x20 [snd_hda_scodec_cs35l41_i2c] i2c_device_probe+0x252/0x2b0 The Linux kernel CVE team has assigned CVE-2022-49515 to this issue. Affected and fixed versions =========================== Issue introduced in 5.16 with commit 6450ef55905688602175fae4ed1bfbfef6a14dde and fixed in 5.17.14 with commit dbc35268e14d5d89c7a9db72009ad4dcd9ede646 Issue introduced in 5.16 with commit 6450ef55905688602175fae4ed1bfbfef6a14dde and fixed in 5.18.3 with commit a59b9958416096dd21dc4f62b0c5be525d459ca8 Issue introduced in 5.16 with commit 6450ef55905688602175fae4ed1bfbfef6a14dde and fixed in 5.19 with commit 9f342904216f378e88008bb0ce1ae200a4b99fe8 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49515 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: include/sound/cs35l41.h sound/soc/codecs/cs35l41-lib.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/dbc35268e14d5d89c7a9db72009ad4dcd9ede646 https://git.kernel.org/stable/c/a59b9958416096dd21dc4f62b0c5be525d459ca8 https://git.kernel.org/stable/c/9f342904216f378e88008bb0ce1ae200a4b99fe8