Critical Vulnerability in Linux Kernel: ASoC Mediatek Platform Entry Issue
Summary
DEBIAN-CVE-2024-42088: In the Linux kernel, the following vulnerability has been resolved: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework c... Affects linux versions < 6.9.8-1. Fixed in 6.9.8-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of many operating systems, providing essential services for hardware and software interaction. It supports a wide range of functionalities, including device drivers, system calls, and process management. The vulnerability in question affects the ASoC (ALSA System on Chip) subsystem, specifically related to the Mediatek platform, which is used for audio processing in various devices. This issue arises from improper handling of platform entries, leading to potential out-of-bounds access.
Vulnerability Detail
In the Linux kernel, a vulnerability was identified in the ASoC subsystem for Mediatek devices, specifically concerning the ETDM1_OUT_BE dai link. The commit e70b8dd26711 inadvertently removed the codec entry for this link instead of replacing it with a COMP_EMPTY() entry. This oversight resulted in an empty platform entry, which can lead to a KASAN out-of-bounds warning in the mtk_soundcard_common_probe function. The code expects the platforms array to have space for at least one entry, and the lack of this can cause undefined behavior, potentially leading to system crashes or security breaches.
How To Fix
Minimum fixed version
6.9.8-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, users can avoid using the affected audio functionalities until the package is updated. However, it is highly recommended to apply the patch as soon as possible to mitigate any risks associated with this vulnerability.
Conclusion
The vulnerability in the Linux kernel's ASoC subsystem poses significant risks, particularly for devices utilizing Mediatek platforms. It is crucial for users to update their systems to the patched version to ensure security and stability. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
The vulnerability is related to improper handling of platform entries in the ASoC subsystem of the Linux kernel, leading to potential out-of-bounds access.
You can use the Vulert platform to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
If exploited, this vulnerability could lead to system crashes, undefined behavior, or security breaches, particularly in audio processing functionalities.
Yes, the permanent fix is to update the Linux package to version 6.9.8-1 or later, which addresses the vulnerability.
If immediate updating is not possible, refrain from using the affected audio functionalities as a temporary workaround until the patch can be applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
