Executive brief
A vulnerability was identified in the Linux kernel's SoundWire audio component that could allow an attacker to cause a system crash or potentially access sensitive information. The issue stems from an incorrect calculation in how the system manages audio data interfaces, leading to memory errors. While no known real-world attacks have been reported, the flaw affects a wide range of Linux versions used in various computing environments.
Technical details
An out-of-bounds (OOB) read vulnerability exists in the SoundWire Cadence master driver (drivers/soundwire/cadence_master.c) within the Linux kernel. The root cause is an incorrect hardcoded offset of 2 applied during PDI (Payload Data Interface) allocation in the sdw_cdns_alloc_pdi function, intended to skip reserved interfaces. This offset can cause the cdns_find_pdi function to access memory outside the bounds of the PDI array. A local attacker can leverage this flaw to trigger a kernel oops (denial of service) or potentially leak information from kernel memory. The issue has been resolved by removing the invalid offset in stable kernel updates.
Affected products
- Linux Linux Kernel up to 5.4.278, 5.5 to 5.10.219, 5.11 to 5.15.161, 5.16 to 6.1.93, 6.2 to 6.6.33, 6.7 to 6.9.4
Timeline
- 2024-03-26: patched: Initial patch authored by Pierre-Louis Bossart
- 2024-06-21: disclosed: CVE published by kernel.org
- 2024-06-21: advisory: NVD record created
References
- https://git.kernel.org/stable/c/002364b2d594a9afc0385c09e00994c510b1d089
- https://git.kernel.org/stable/c/2ebcaa0e5db9b6044bb487ae1cf41bc601761567
- https://git.kernel.org/stable/c/4e99103f757cdf636c6ee860994a19a346a11785
- https://git.kernel.org/stable/c/7eeef1e935d23db5265233d92395bd5c648a4021
- https://git.kernel.org/stable/c/8ee1b439b1540ae543149b15a2a61b9dff937d91
- https://git.kernel.org/stable/c/902f6d656441a511ac25c6cffce74496db10a078
- https://git.kernel.org/stable/c/fd4bcb991ebaf0d1813d81d9983cfa99f9ef5328