Bug 2300407 (CVE-2024-41038)

Summary: CVE-2024-41038 kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: dfreiber, drow, jburrell, vkumar
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: kernel 6.1.100, kernel 6.6.41, kernel 6.9.10, kernel 6.10 Doc Type: If docs needed, set a value
Doc Text:
A vulnerability was found in the Linux kernel in the cs_dsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an overflow of the firmware data buffer, leading to memory overwrite and potential system instability.
Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 2301549    
Bug Blocks:    

Description OSIDB Bzimport 2024-07-29 15:33:02 UTC
In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

Check that all fields of a V2 algorithm header fit into the available
firmware data buffer.

The wmfw V2 format introduced variable-length strings in the algorithm
block header. This means the overall header length is variable, and the
position of most fields varies depending on the length of the string
fields. Each field must be checked to ensure that it does not overflow
the firmware data buffer.

As this ia bugfix patch, the fixes avoid making any significant change to
the existing code. This makes it easier to review and less likely to
introduce new bugs.

Comment 1 Mauro Matteo Cascella 2024-07-30 09:12:31 UTC
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072923-CVE-2024-41038-41ba@gregkh/T

Comment 2 Mauro Matteo Cascella 2024-07-30 09:12:52 UTC
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301549]

Comment 131 errata-xmlrpc 2024-09-24 00:39:39 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001

Comment 132 errata-xmlrpc 2024-09-24 02:35:01 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000

Comment 133 errata-xmlrpc 2024-11-12 09:36:35 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9

Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315

Comment 134 errata-xmlrpc 2024-12-04 00:46:08 UTC
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.4 Extended Update Support

Via RHSA-2024:10771 https://access.redhat.com/errata/RHSA-2024:10771