In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Use correct version for UAC3 header validation The entry of the validators table for UAC3 AC header descriptor is defined with the wrong protocol version UAC_VERSION_2, while it should have been UAC_VERSION_3. This results in the validator never matching for actual UAC3 devices (protocol == UAC_VERSION_3), causing their header descriptors to bypass validation entirely. A malicious USB device presenting a truncated UAC3 header could exploit this to cause out-of-bounds reads when the driver later accesses unvalidated descriptor fields. The bug was introduced in the same commit as the recently fixed UAC3 feature unit sub-type typo, and appears to be from the same copy-paste error when the UAC3 section was created from the UAC2 section.
En el kernel de Linux, la siguiente vulnerabilidad ha sido resuelta: ALSA: usb-audio: Usar la versión correcta para la validación del encabezado UAC3 La entrada de la tabla de validadores para el descriptor de encabezado AC UAC3 está definida con la versión de protocolo incorrecta UAC_VERSION_2, mientras que debería haber sido UAC_VERSION_3. Esto resulta en que el validador nunca coincida para dispositivos UAC3 reales (protocolo == UAC_VERSION_3), haciendo que sus descriptores de encabezado omitan la validación por completo. Un dispositivo USB malicioso que presente un encabezado UAC3 truncado podría explotar esto para causar lecturas fuera de límites cuando el controlador acceda posteriormente a campos de descriptor no validados. El error fue introducido en el mismo commit que el error tipográfico del subtipo de unidad de característica UAC3 recientemente corregido, y parece provenir del mismo error de copiar y pegar cuando la sección UAC3 fue creada a partir de la sección UAC2.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H
| Attack Vector | LOCAL |
|---|---|
| Attack Complexity | LOW |
| Privileges Required | LOW |
| User Interaction | NONE |
| Scope | UNCHANGED |
| Confidentiality Impact | HIGH |
| Integrity Impact | NONE |
| Availability Impact | HIGH |
| Source | Type | Description |
|---|---|---|
| [email protected] | Primary |
en
CWE-125
|
| Vendor | Product | Version | Update | Type |
|---|---|---|---|---|
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341beb2c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341bebd80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd319dd5000> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd31b2370c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341be8280> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd341be8a80> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a7387c0> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd36a738400> | Operating System |
| linux | linux_kernel | * | <built-in method update of dict object at 0x7fd31b236600> | Operating System |
| linux | linux_kernel | 5.4 | <built-in method update of dict object at 0x7fd341bea240> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36b156bc0> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36a73a000> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd384121c80> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd341256480> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd36a738880> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd384aa0700> | Operating System |
| linux | linux_kernel | 7.0 | <built-in method update of dict object at 0x7fd341bebf00> | Operating System |
| Vulnerable | CPE |
|---|---|
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:5.4:-:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc1:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc2:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc3:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc4:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc5:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc6:*:*:*:*:*:* |
| Yes | cpe:2.3:o:linux:linux_kernel:7.0:rc7:*:*:*:*:*:* |