Out-of-Bounds Access Vulnerability in Linux Kernel Soundwire Package
Summary
CVE-2024-38635: In the Linux kernel, the following vulnerability has been resolved: soundwire: cadence: fix invalid PDI offset For some reason, we add an offset to the PDI, presumably to skip the PDI0 and PDI1 which are reserved for BPT... Affects linux versions < 5.10.221-1. Fixed in 5.10.221-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interactions. The Soundwire subsystem is designed for audio data transport, allowing communication between audio devices and the processor. This vulnerability affects the Soundwire implementation, specifically related to the handling of Peripheral Data Interfaces (PDIs).
Vulnerability Detail
In the Linux kernel, an out-of-bounds access vulnerability was identified in the Soundwire subsystem due to an incorrect offset added to the Peripheral Data Interface (PDI). This flaw could potentially lead to unauthorized access to memory locations, resulting in system instability or crashes. The issue arose from the assumption that certain PDIs were reserved, leading to an erroneous calculation that could exceed the bounds of the PDI array. Although no known platforms have been reported to exploit this vulnerability, the risk remains due to the potential for future exploitation.
How To Fix
Minimum fixed version
5.10.221-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability, as the best course of action is to apply the kernel updates mentioned above.
Conclusion
The CVE-2024-38635 vulnerability in the Linux kernel's Soundwire subsystem poses a significant risk due to out-of-bounds memory access. Users are strongly advised to update their systems to the latest kernel versions to mitigate this risk. Utilizing tools like Vulert can help monitor and alert for such vulnerabilities in real-time.
See every vulnerability recorded for linux →
FAQ
CVE-2024-38635 is a vulnerability in the Linux kernel's Soundwire subsystem that allows for out-of-bounds memory access due to incorrect handling of Peripheral Data Interfaces.
You can use Vulert, which monitors open-source vulnerabilities in your software. By uploading your manifest file, such as package-lock.json, you can check for vulnerabilities without needing to install any software.
The primary risk is out-of-bounds memory access, which could lead to system crashes, instability, or potential exploitation by malicious actors.
Yes, users should upgrade to the following versions to mitigate the vulnerability: Debian 11: 5.10.221-1, Debian 12: 6.1.94-1, and Debian 13: 6.9.7-1.
While there are no specific workarounds, it is crucial to prioritize updating your kernel as soon as possible to protect against potential exploitation.
Related vulnerabilities
Recent vulnerabilities recorded for linux.
