Bug 2300430 (CVE-2024-41056) - CVE-2024-41056 kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
Summary: CVE-2024-41056 kernel: firmware: cs_dsp: Use strnlen() on name fields in V1 w...
Keywords:
Status: NEW
Alias: CVE-2024-41056
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security DevOps Team
QA Contact:
URL:
Whiteboard:
Depends On: 2301590
Blocks:
TreeView+ depends on / blocked
 
Reported: 2024-07-29 15:41 UTC by OSIDB Bzimport
Modified: 2024-10-17 06:46 UTC (History)
4 users (show)

Fixed In Version: kernel 6.1.100, kernel 6.6.41, kernel 6.9.10, kernel 6.10
Doc Type: If docs needed, set a value
Doc Text:
A buffer overrun flaw exists in the linux kernel as strlen is used on name fields in V1 wmfw files.This results in loss of availability of the system.
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHBA-2024:7043 0 None None None 2024-09-24 09:43:25 UTC
Red Hat Product Errata RHBA-2024:7198 0 None None None 2024-09-26 09:49:06 UTC
Red Hat Product Errata RHBA-2024:7236 0 None None None 2024-09-26 14:37:56 UTC
Red Hat Product Errata RHBA-2024:7637 0 None None None 2024-10-03 14:46:14 UTC
Red Hat Product Errata RHBA-2024:8227 0 None None None 2024-10-17 06:46:11 UTC
Red Hat Product Errata RHSA-2024:7000 0 None None None 2024-09-24 02:35:09 UTC
Red Hat Product Errata RHSA-2024:7001 0 None None None 2024-09-24 00:39:46 UTC
Red Hat Product Errata RHSA-2024:8157 0 None None None 2024-10-16 00:20:27 UTC
Red Hat Product Errata RHSA-2024:8158 0 None None None 2024-10-16 00:09:27 UTC

Description OSIDB Bzimport 2024-07-29 15:41:47 UTC 
In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files

Use strnlen() instead of strlen() on the algorithm and coefficient name
string arrays in V1 wmfw files.

In V1 wmfw files the name is a NUL-terminated string in a fixed-size
array. cs_dsp should protect against overrunning the array if the NUL
terminator is missing.
Comment 1 Mauro Matteo Cascella 2024-07-30 11:01:55 UTC 
Upstream advisory:
https://lore.kernel.org/linux-cve-announce/2024072930-CVE-2024-41056-c324@gregkh/T
Comment 2 Mauro Matteo Cascella 2024-07-30 11:02:17 UTC 
Created kernel tracking bugs for this issue:

Affects: fedora-all [bug 2301590]
Comment 131 errata-xmlrpc 2024-09-24 00:39:45 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7001 https://access.redhat.com/errata/RHSA-2024:7001
Comment 132 errata-xmlrpc 2024-09-24 02:35:07 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 8

Via RHSA-2024:7000 https://access.redhat.com/errata/RHSA-2024:7000
Comment 133 errata-xmlrpc 2024-10-16 00:09:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:8158 https://access.redhat.com/errata/RHSA-2024:8158
Comment 134 errata-xmlrpc 2024-10-16 00:20:26 UTC 
This issue has been addressed in the following products:

  Red Hat Enterprise Linux 9.2 Extended Update Support

Via RHSA-2024:8157 https://access.redhat.com/errata/RHSA-2024:8157
Note You need to log in before you can comment on or make changes to this bug.