Executive brief
The Linux kernel's ASoC audio subsystem contains a buffer overread vulnerability in the LPASS (Low Power Audio SubSystem) codec driver. An attacker with local access can trigger out-of-bounds memory reads by providing invalid enumeration values, potentially crashing the system or leaking sensitive data from kernel memory.
Technical details
The vulnerability is a slab-out-of-bounds read in the regcache_flat_read function triggered via the tx_macro_put_dec_enum() handler in the LPASS TX macro codec driver (sound/soc/codecs/lpass-tx-macro.c). The root cause is missing input validation: the code accepts an enumeration value from user-controlled audio control data without checking whether it falls within the valid range (0 to e->items-1), and also lacks validation of register configuration values. When an out-of-range value is passed, it causes the regcache to read beyond allocated buffer boundaries. The vulnerability is triggered through audio control interface writes accessible to local users. The fix adds two validation checks: one to reject enumeration values >= e->items, and another to handle unexpected register configuration cases with a default error path.
Affected products
- Linux Linux kernel multiple versions through 2023-05
Timeline
- 2023-05-11: disclosed: Initial commit by Ravulapati Vishnu Vardhan Rao
- 2023-05-17: patched: Patch merged upstream by Mark Brown
- 2023-05-30: patched: Patch released in stable kernels by Greg Kroah-Hartman