ASoC Codecs va-macro: Array Out of Bounds Access Vulnerability
Summary
GSD-2022-1001263: ASoC: codecs: va-macro: fix accessing array out of bounds for enum type. Affects Kernel versions >= 908e6b1df26efc9d2df70c9a7bf4f5eae5c5702f, < c0099bbf8bc85d30c4cf38220fca3c8d4253fa7f. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ASoC (Audio System on Chip) is a subsystem in the Linux kernel that provides support for audio devices integrated into system-on-chip (SoC) platforms. It includes codecs, which are responsible for encoding and decoding audio signals. The va-macro codec is one such component. It allows for the configuration of various audio parameters using an enum type array. However, a vulnerability has been discovered in the va-macro codec that allows for accessing the array out of bounds, potentially leading to memory corruption or other security issues.
Vulnerability Detail
The vulnerability in the ASoC va-macro codec arises from improper bounds checking when accessing the enum type array. By providing a malicious input, an attacker can trigger an out-of-bounds access, leading to undefined behavior. This could potentially be exploited to overwrite adjacent memory, execute arbitrary code, or cause a denial-of-service condition. The vulnerability was introduced in Linux Kernel version v5.11 and has been fixed in version v5.17.2.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can disable the va-macro codec or remove it from the kernel configuration if it is not required for their specific use case. This can be done by modifying the kernel configuration file and rebuilding the kernel without the va-macro codec.
Conclusion
The ASoC va-macro codec vulnerability allows for accessing an array out of bounds, potentially leading to memory corruption or other security issues. It is recommended to update the Linux Kernel to version v5.17.2 or later to fix this vulnerability. Users can also disable or remove the va-macro codec as a workaround. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for Kernel →
FAQ
ASoC stands for Audio System on Chip. It is a subsystem in the Linux kernel that provides support for audio devices integrated into system-on-chip (SoC) platforms.
The va-macro codec is a component of ASoC that allows for the configuration of various audio parameters using an enum type array.
The vulnerability occurs due to improper bounds checking when accessing the enum type array in the va-macro codec. This allows for out-of-bounds access and potential memory corruption.
The vulnerability could be exploited to overwrite adjacent memory, execute arbitrary code, or cause a denial-of-service condition.
Yes, the vulnerability has been fixed in Linux Kernel version v5.17.2.
Related vulnerabilities
Recent vulnerabilities recorded for Kernel.
