In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: caiaq: validate EP1 reply lengths
usb_ep1_command_reply_dispatch() uses buf[0] as a command byte and then
reads command-specific fixed items from the same URB buffer. Several
paths use buf + 1, buf[1], buf[2], or buf + 3 without first proving that
urb->actual_length contains those bytes.
Add per-command length checks, use a payload length derived from the
bytes after the command byte for the control-state copy, and reject short
analog input payloads before the input helper reads fixed offsets from
the EP1 reply.
523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 91acd231f219452fa58285239f83945accad9513; 523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 7cc6b3745a0cea697c8d0684b3094f220281a08d; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before add9328c91c195c494cd68a21b19e5e47a20d784; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before 319393151367e6626affedcdd4f7b7b0286f4246; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before af8a172c4f71ac30d625f2966d2389a7fa872819; 523f1dce37434a9a6623bf46e7893e2b4b10ac3c builds before 74f3c639f64fa5da4e1613149798b5089bce2807; from 523f1dce37434a9a6623bf46e7893e2b4b10ac3c before aba30af07d4fe499b50209801eba9da8a815522f
The CVE record is authoritative. Products marked “from the name” were identified from the CNA's free-text names, not a CPE, and are matched less certainly. This product uses the NVD API but is not endorsed or certified by the NVD.
Printed from infosecsignals.com. Every record links back to the agency that published it.
Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.
