Vulnerabilities

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: compress: Fix task creation error unwind<br /> <br /> snd_compr_task_new() allocates the driver task before validating the<br /> returned DMA buffers and reserving file descriptors. When either of<br /> those later steps fails, the core frees its task wrapper and DMA-buffer<br /> references without calling the driver&amp;#39;s task_free() callback. Any<br /> driver resources allocated by task_create() are therefore leaked.<br /> <br /> The dual-fd allocation path also jumps to cleanup without storing the<br /> negative get_unused_fd_flags() result in retval. Since retval still<br /> contains the successful task_create() return value, TASK_CREATE can<br /> incorrectly report success although the task was discarded.<br /> <br /> Preserve the fd allocation errors and call task_free() when failure<br /> occurs after a successful task_create() callback.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: virtio: Validate control metadata from the device<br /> <br /> virtio-snd control handling trusts the device-provided control type and<br /> value count returned by the device.<br /> <br /> That metadata is then used directly to index g_v2a_type_map[] in<br /> virtsnd_kctl_info(), and to size loops and memcpy() operations in<br /> virtsnd_kctl_get() and virtsnd_kctl_put() against fixed-size<br /> virtio_snd_ctl_value and snd_ctl_elem_value arrays.<br /> <br /> A buggy or malicious device can therefore trigger out-of-bounds access by<br /> advertising an invalid control type or an oversized value count.<br /> <br /> Validate control type and count once in virtsnd_kctl_parse_cfg(), before<br /> querying enumerated items or exposing the control to ALSA.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> vfio/pci: Latch disable_idle_d3 per device<br /> <br /> When disable_idle_d3 was introduced in vfio-pci, it directly manipulated<br /> the device power state with pci_set_power_state(). There were no<br /> refcounts to maintain or balanced operations, we could unconditionally<br /> bring the device to D0 and conditionally move it to D3hot. Therefore<br /> the module parameter was made writable.<br /> <br /> Later, in commit c61302aa48f7 ("vfio/pci: Move module parameters to<br /> vfio_pci.c"), as part of the vfio-pci-core split, the writable aspect<br /> of the module parameter was nullified. The parameter value could still<br /> be changed through sysfs, but the vfio-pci driver latched the values<br /> into vfio-pci-core globals at module init. Loading the vfio-pci module,<br /> or unloading and reloading, with non-default or different values could<br /> change the globals relative to existing devices bound to vfio-pci<br /> variant drivers.<br /> <br /> Runtime PM was introduced in commit 7ab5e10eda02 ("vfio/pci: Move the<br /> unused device into low power state with runtime PM"), which marks the<br /> point where power states became refcounted. PM get and put operations<br /> need to be balanced, but the same module operations noted above can<br /> change the global variables relative to those devices already bound to<br /> vfio-pci variant drivers. This introduces a window where PM operations<br /> can now become unbalanced.<br /> <br /> To resolve this with a narrow footprint for stable backports, the<br /> disable_idle_d3 flag is latched into the vfio_pci_core_device at the<br /> time of initialization, such that the device always operates with a<br /> consistent value.<br /> <br /> NB. vfio_pci_dev_set_try_reset() now unconditionally raises the<br /> runtime PM usage count around bus reset to account for disable_idle_d3<br /> becoming a per-device rather than global flag. When this flag is set,<br /> the additional get/put pair is harmless and allows continued use of the<br /> shared vfio_pci_dev_set_pm_runtime_get() helper.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> x86,fs/resctrl: Prevent out-of-bounds access while offlining CPU when SNC enabled<br /> <br /> The architecture updates the cpu_mask in a domain&amp;#39;s header to track which<br /> online CPUs are associated with the domain. When this mask becomes empty<br /> the architecture initiates offline of the domain that includes calling<br /> on resctrl fs to offline the domain. If it is a monitoring domain in<br /> which LLC occupancy is tracked resctrl fs forces the limbo handler to<br /> clear all busy RMID state associated with the domain.<br /> <br /> The limbo handler always reads the current event value associated with a<br /> busy RMID irrespective of it being checked as part of regular "is it still<br /> busy" check or whether it will be forced released anyway. When reading an<br /> RMID on a system with SNC enabled the "logical RMID" is converted to the<br /> "physical RMID" and this conversion requires the NUMA node ID of the<br /> resctrl monitoring domain that is in turn determined by querying the NUMA<br /> node ID of any CPU belonging to the monitoring domain.<br /> <br /> When the monitoring domain is going offline its cpu_mask is empty causing<br /> the NUMA node ID query via cpu_to_node() to be done with "nr_cpu_ids" as<br /> argument resulting in an out-of-bounds access.<br /> <br /> Refactor the limbo handler to skip reading the RMID when the RMID will<br /> just be forced to no longer be dirty in the domain anyway. Add a safety<br /> check to the architecture&amp;#39;s RMID reader to protect against this scenario.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: usb-audio: avoid kobject path lookup in DualSense match<br /> <br /> The DualSense jack-detection input handler verifies that a matching input<br /> device belongs to the same physical controller by building kobject path<br /> strings for both the input device and the USB audio device, then comparing<br /> the path prefix.<br /> <br /> This was observed when a weak physical connection caused the controller<br /> to rapidly disconnect and reconnect. During that repeated hotplug,<br /> snd_dualsense_ih_match() can run while the controller&amp;#39;s USB device is<br /> being disconnected. kobject_get_path() walks ancestor kobjects and<br /> dereferences their names; if the USB device kobject name is no longer<br /> valid, this can fault in strlen():<br /> <br /> RIP: 0010:strlen+0x10/0x30<br /> Call Trace:<br /> kobject_get_path+0x34/0x150<br /> snd_dualsense_ih_match+0x49/0xd0 [snd_usb_audio]<br /> input_register_device+0x566/0x6a0<br /> ps_probe+0xb89/0x1590 [hid_playstation]<br /> <br /> The same ownership check can be done without building kobject path<br /> strings. The input device is parented below the HID device, USB interface<br /> and USB device, so walking the input device parent chain and comparing<br /> against the mixer USB device preserves the check without dereferencing<br /> kobject names during disconnect.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: seq: Fix uninitialised heap leak in snd_seq_event_dup()<br /> <br /> snd_seq_event_dup() copies an incoming event into a pool cell and, in<br /> the UMP-enabled build, clears the trailing cell-&gt;ump.raw.extra word that<br /> the memcpy() did not cover. The guard deciding whether to clear it<br /> compares the copied size against sizeof(cell-&gt;event):<br /> <br /> memcpy(&amp;cell-&gt;ump, event, size);<br /> if (size event))<br /> cell-&gt;ump.raw.extra = 0;<br /> <br /> For a legacy (non-UMP) event, size == sizeof(struct snd_seq_event) ==<br /> sizeof(cell-&gt;event), so the condition is false and the extra word keeps<br /> stale data. The cell pool is allocated with kvmalloc() (not zeroed) and<br /> cells are reused via a free list, so that word holds uninitialised heap<br /> or leftover event data.<br /> <br /> When such a cell is delivered to a UMP client (client-&gt;midi_version &gt; 0)<br /> that set SNDRV_SEQ_FILTER_NO_CONVERT -- so the legacy event reaches it<br /> unconverted -- snd_seq_read() reads it out as the larger struct<br /> snd_seq_ump_event and copies the stale word to user space, a 4-byte<br /> kernel heap infoleak to an unprivileged /dev/snd/seq client.<br /> <br /> Compare against sizeof(cell-&gt;ump) instead, so the trailing word is zeroed<br /> for every event shorter than the UMP cell.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: ice1712: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails. The<br /> ice1712 driver calls snd_ctl_new1() without checking the return value<br /> before dereferencing the pointer in multiple places (ice1712.c,<br /> ice1724.c, aureon.c), which can lead to NULL pointer dereferences.<br /> <br /> Add NULL checks after snd_ctl_new1() calls and return -ENOMEM if any<br /> fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: gus: check snd_ctl_new1() return value<br /> <br /> snd_ctl_new1() can return NULL when memory allocation fails.<br /> snd_gf1_pcm_volume_control() does not check the return value before<br /> dereferencing kctl-&gt;id.index, which can lead to a NULL pointer<br /> dereference.<br /> <br /> Add a NULL check after snd_ctl_new1() and return -ENOMEM if it fails.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: firewire: isight: bound the sample count to the packet payload<br /> <br /> isight_packet() takes the frame count from the device iso packet and<br /> checks it only against the device claimed iso length.<br /> <br /> count = be32_to_cpu(payload-&gt;sample_count);<br /> if (likely(count samples, count);<br /> <br /> length is the iso header data_length. It can be up to 0xffff. So the<br /> gate allows a count up to about 16379. isight_samples() then copies<br /> count frames out of payload-&gt;samples into the PCM DMA buffer.<br /> <br /> payload-&gt;samples holds only 2 * MAX_FRAMES_PER_PACKET values. The<br /> device multiplexes two samples per frame. A count past<br /> MAX_FRAMES_PER_PACKET reads past the payload. A count past the buffer<br /> size writes past runtime-&gt;dma_area. The smallest PCM buffer is larger<br /> than MAX_FRAMES_PER_PACKET. Bounding the count to MAX_FRAMES_PER_PACKET<br /> keeps both the read and the write in range.<br /> <br /> A malicious or faulty Apple iSight on the FireWire bus reaches this<br /> during a normal capture.<br /> <br /> Add the MAX_FRAMES_PER_PACKET bound to the gate.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> ALSA: hda/cs35l41: Fix firmware load work teardown<br /> <br /> cs35l41_hda creates ALSA controls whose private data points at the<br /> cs35l41_hda object. The firmware load control can also queue<br /> fw_load_work.<br /> <br /> Those controls are not removed on component unbind, and device remove<br /> only cancels fw_load_work through cs35l41_remove_dsp(). That helper is<br /> skipped when halo_initialized is false. With firmware_autostart<br /> disabled, a firmware load can be requested before the DSP has been<br /> initialized. If the component or device is removed before the queued<br /> work runs, the worker can run after teardown and dereference driver<br /> state that is no longer valid.<br /> <br /> Track the created controls and remove them on unbind so no new control<br /> callback can reach the driver data or queue more work. Then cancel<br /> fw_load_work to drain any request that was already queued. Also cancel<br /> the work unconditionally during device remove before runtime PM teardown.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on marvell probe failure<br /> <br /> Make sure to stop any TX URBs submitted during Marvell OOB wakeup<br /> configuration on later probe failures to avoid use-after-free in the<br /> completion callback.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.

In the Linux kernel, the following vulnerability has been resolved:<br /> <br /> Bluetooth: btusb: fix use-after-free on registration failure<br /> <br /> Make sure to release the sibling interfaces in case controller<br /> registration fails to avoid use-after-free and double-free when they are<br /> eventually disconnected.<br /> <br /> This issue was reported by Sashiko while reviewing a fix for a wakeup<br /> source leak in the btusb probe errors paths.