Bug 2300408 (CVE-2024-41039)
Summary: | CVE-2024-41039 kernel: firmware: cs_dsp: Fix overflow checking of wmfw header | ||
---|---|---|---|
Product: | [Other] Security Response | Reporter: | OSIDB Bzimport <bzimport> |
Component: | vulnerability | Assignee: | Product Security DevOps Team <prodsec-dev> |
Status: | NEW --- | QA Contact: | |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | unspecified | CC: | dfreiber, drow, jburrell, vkumar |
Target Milestone: | --- | Keywords: | Security |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | kernel 6.1.100, kernel 6.6.41, kernel 6.9.10, kernel 6.10 | Doc Type: | If docs needed, set a value |
Doc Text: |
A vulnerability was found in the Linux kernel's firmware driver cs_dsp.c, where a buffer overflow is possible in the wmfw header due to insufficient buffer size checks. The issue stems from the size of one of the structs that the code checks, the wmfw_adsp?_sizes struct, which can vary depending on whether the firmware used is ADSP1 or ADSP2 and Halo Core. In the second case, the wmfw_adsp2_sizes struct is 4 bytes longer, which can cause a buffer overflow, potentially leading to undefined behavior in the system.
|
Story Points: | --- |
Clone Of: | Environment: | ||
Last Closed: | Type: | --- | |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | 2301552 | ||
Bug Blocks: |
Description
OSIDB Bzimport
2024-07-29 15:33:15 UTC
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024072924-CVE-2024-41039-b3bc@gregkh/T Created kernel tracking bugs for this issue: Affects: fedora-all [bug 2301552] This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001 This issue has been addressed in the following products: Red Hat Enterprise Linux 8 Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000 This issue has been addressed in the following products: Red Hat Enterprise Linux 9 Via RHSA-2024:9315 https://access.redhat.com/errata/RHSA-2024:9315 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:9498 https://access.redhat.com/errata/RHSA-2024:9498 This issue has been addressed in the following products: Red Hat Enterprise Linux 9.2 Extended Update Support Via RHSA-2024:9497 https://access.redhat.com/errata/RHSA-2024:9497 |