From mboxrd@z Thu Jan 1 00:00:00 1970 Received: from smtp.kernel.org (aws-us-west-2-korg-mail-1.web.codeaurora.org [10.30.226.201]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.subspace.kernel.org (Postfix) with ESMTPS id 1109D219A8C for ; Wed, 26 Feb 2025 02:15:47 +0000 (UTC) Authentication-Results: smtp.subspace.kernel.org; arc=none smtp.client-ip=10.30.226.201 ARC-Seal:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536147; cv=none; b=riSvv40zCw6MyU3ysvf0+hwXBMefDMAlyDjknoF3Wuw/ES73bK4hc5Yij6cSBGyo4T9afheYMdDVtNaSnzn0ITEA+i95mBas43aBlwuZhdUK4fxzs9oqM3VlK1S6rwWeFsb4xxN0UcRLYVitIyQHcyQUxhP59/+J3DtPGSRgYKw= ARC-Message-Signature:i=1; a=rsa-sha256; d=subspace.kernel.org; s=arc-20240116; t=1740536147; c=relaxed/simple; bh=dAGVuzrAACT4d8boR0Gj98OpXlObb1FkSznci5kr1aA=; h=From:To:Cc:Subject:Date:Message-ID:MIME-Version; b=Q9rXKUiidnGELKACVFDsJ/a2tmUtTFCzPSa+mG0Dprm817sa6UEO3CaY76x3dfERDZYexOyxRmUkc2XEjrnG7lq0xS8xtUskur2eied5/TlAn2Bk71/btsNQ7C2lWNq71216UZ0Aa9/mU1FeYSdD7zMFZEv9D1TbNbWvVQ7I94E= ARC-Authentication-Results:i=1; smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b=TYwRmFA4; arc=none smtp.client-ip=10.30.226.201 Authentication-Results: smtp.subspace.kernel.org; dkim=pass (1024-bit key) header.d=linuxfoundation.org header.i=@linuxfoundation.org header.b="TYwRmFA4" Received: by smtp.kernel.org (Postfix) with ESMTPSA id D716DC4CEDD; Wed, 26 Feb 2025 02:15:46 +0000 (UTC) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/simple; d=linuxfoundation.org; s=korg; t=1740536146; bh=dAGVuzrAACT4d8boR0Gj98OpXlObb1FkSznci5kr1aA=; h=From:To:Cc:Subject:Date:Reply-to:From; b=TYwRmFA44wn+0yPVHdJhvg9W+5vGl7fy2EwmFVE3z1pqAnGLM93m9C9vvvmzANxNi fmcxp8eJwM+jMgtvZNo7/n5qn+TEW/19g4Ne29YxphwDx/1Ocz/Z0eWw6cpl8STDW5 +hGP8VnVqNcDMwMfRR59biRtrXjTIMIodpm9lp+k= From: Greg Kroah-Hartman To: linux-cve-announce@vger.kernel.org Cc: Greg Kroah-Hartman Subject: CVE-2022-49518: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload Date: Wed, 26 Feb 2025 03:13:12 +0100 Message-ID: <2025022610-CVE-2022-49518-082d@gregkh> X-Mailer: git-send-email 2.48.1 Precedence: bulk X-Mailing-List: linux-cve-announce@vger.kernel.org List-Id: List-Subscribe: List-Unsubscribe: MIME-Version: 1.0 Reply-to: , X-Developer-Signature: v=1; a=openpgp-sha256; l=2492; i=gregkh@linuxfoundation.org; h=from:subject:message-id; bh=dAGVuzrAACT4d8boR0Gj98OpXlObb1FkSznci5kr1aA=; b=owGbwMvMwCRo6H6F97bub03G02pJDOn7Kpj23YyL+HnkyWsfhZ8is38/S7/mtbi9MeWX/g3nX z5BchWJHbEsDIJMDLJiiixftvEc3V9xSNHL0PY0zBxWJpAhDFycAjARs4sMcwX379mhL9V4kTlv wtNOmWI/gUeMNxkWrFp1Qk375t5UnbdeZa8OCJ1pXFtaCQA= X-Developer-Key: i=gregkh@linuxfoundation.org; a=openpgp; fpr=F4B60CC5BF78C2214A313DCB3147D40DDB2DFB29 Content-Transfer-Encoding: 8bit Description =========== In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload It is possible to craft a topology where sof_get_control_data() would do out of bounds access because it expects that it is only called when the payload is bytes type. Confusingly it also handles other types of controls, but the payload parsing implementation is only valid for bytes. Fix the code to count the non bytes controls and instead of storing a pointer to sof_abi_hdr in sof_widget_data (which is only valid for bytes), store the pointer to the data itself and add a new member to save the size of the data. In case of non bytes controls we store the pointer to the chanv itself, which is just an array of values at the end. In case of bytes control, drop the wrong cdata->data (wdata[i].pdata) check against NULL since it is incorrect and invalid in this context. The data is pointing to the end of cdata struct, so it should never be null. The Linux kernel CVE team has assigned CVE-2022-49518 to this issue. Affected and fixed versions =========================== Fixed in 5.18.3 with commit 896b03bb7c7010042786cfae2115083d4c241dd3 Fixed in 5.19 with commit a962890a5a3cce903ff7c7a19fadee63ed9efdc7 Please see https://www.kernel.org for a full list of currently supported kernel versions by the kernel community. Unaffected versions might change over time as fixes are backported to older supported kernel versions. The official CVE entry at https://cve.org/CVERecord/?id=CVE-2022-49518 will be updated if fixes are backported, please check that for the most up to date information about this issue. Affected files ============== The file(s) affected by this issue are: sound/soc/sof/ipc3-topology.c Mitigation ========== The Linux kernel CVE team recommends that you update to the latest stable kernel version for this, and many other bugfixes. Individual changes are never tested alone, but rather are part of a larger kernel release. Cherry-picking individual commits is not recommended or supported by the Linux kernel community at all. If however, updating to the latest release is impossible, the individual changes to resolve this issue can be found at these commits: https://git.kernel.org/stable/c/896b03bb7c7010042786cfae2115083d4c241dd3 https://git.kernel.org/stable/c/a962890a5a3cce903ff7c7a19fadee63ed9efdc7