public inbox for linux-kernel@vger.kernel.org
 help / color / mirror / Atom feed
From: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
To: Siddh Raman Pant <siddh.raman.pant@oracle.com>
Cc: "cve@kernel.org" <cve@kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>
Subject: Re: CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
Date: Mon, 6 Oct 2025 10:14:23 +0200	[thread overview]
Message-ID: <2025100646-strategy-spindle-ae8a@gregkh> (raw)
In-Reply-To: <f24f4524894417954b9de4ccec69c2e17aae3d5f.camel@oracle.com>

On Mon, Oct 06, 2025 at 07:07:00AM +0000, Siddh Raman Pant wrote:
> On Thu, 11 Sep 2025 18:52:52 +0200, Greg Kroah-Hartman wrote:
> > ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
> > 
> > The 'sprintf' call in 'add_tuning_control' may exceed the 44-byte
> > buffer if either string argument is too long. This triggers a compiler
> > warning.
> > Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent
> > overflow.
> > 
> > The Linux kernel CVE team has assigned CVE-2025-39751 to this issue.
> 
> While the change is good for defensive reasons, there isn't actually
> any buffer overflow as it is to "fix".
> 
> The largest string possible is "Wedge Angle Playback Volume", whose
> length is less than 44.

Thanks for the info.  What was the compiler warning about then if it
could detect just how big the string would always be as these are static
values?

Should this CVE be rejected?

thanks,

greg k-h

  reply	other threads:[~2025-10-06  8:14 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <2025091142-CVE-2025-39751-c340@gregkh>
2025-10-06  7:07 ` CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control Siddh Raman Pant
2025-10-06  8:14   ` gregkh [this message]
2025-10-06  9:19     ` Siddh Raman Pant
2025-10-06  9:53       ` gregkh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=2025100646-strategy-spindle-ae8a@gregkh \
    --to=gregkh@linuxfoundation.org \
    --cc=cve@kernel.org \
    --cc=linux-kernel@vger.kernel.org \
    --cc=siddh.raman.pant@oracle.com \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox