In the Linux kernel, the following vulnerability has been resolved:
ALSA: scarlett2: Fix buffer overflow in config retrieval
The scarlett2_usb_get_config() function has a logic error in the
endianness conversion code that can cause buffer overflows when
count > 1.
The code checks `if (size == 2)` where `size` is the total buffer size in
bytes, then loops `count` times treating each element as u16 (2 bytes).
This causes the loop to access `count * 2` bytes when the buffer only
has `size` bytes allocated.
Fix by checking the element size (config_item->size) instead of the
total buffer size. This ensures the endianness conversion matches the
actual element type.
CVSS
7.8 HIGH (v3.1, NVD)CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
from ac34df733d2dfe3b553897a1e9e1a44414f09834 before d5e80d1f97ae55bcea1426f551e4419245b41b9c; from ac34df733d2dfe3b553897a1e9e1a44414f09834 before 51049f6e3f05d70660e2458ad3bb302a3721b751; from ac34df733d2dfe3b553897a1e9e1a44414f09834 before 91a756d22f0482eac5bedb113c8922f90b254449; from ac34df733d2dfe3b553897a1e9e1a44414f09834 before 27049f50be9f5ae3a62d272128ce0b381cb26a24; from ac34df733d2dfe3b553897a1e9e1a44414f09834 before 31a3eba5c265a763260976674a22851e83128f6d; from ac34df733d2dfe3b553897a1e9e1a44414f09834 before 6f5c69f72e50d51be3a8c028ae7eda42c82902cb
from 5.14 before 5.15.199; from 5.16 before 6.1.162; from 6.2 before 6.6.122; from 6.7 before 6.12.68; from 6.13 before 6.18.8; 6.19; 6.19; 6.19; and 3 more ranges
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
