In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-control: Validate size in snd_sof_update_control
In snd_sof_update_control(), firmware-provided cdata->num_elems is
checked against local_cdata->data->size but never against the actual
allocation size. If local_cdata->data->size was previously set to an
inconsistent value, the memcpy could write past the allocated buffer.
Add a bounds check to ensure num_elems fits within the available space
in the ipc_control_data allocation before copying.
Attack Parameters
Attack Vector
Local
Requires local access
Attack Complexity
Low
Easy to exploit
Privileges Required
Low
Basic privileges needed
User Interaction
None
No user interaction needed
Impact Assessment
Confidentiality
High
Complete data leak
Integrity
High
Complete data modification
Availability
High
Complete denial of service
CVSS Vector v3.1
References 6
https://git.kernel.org/stable/c/1dc25a3e06364f48c4ef06016852f8b82425151a
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/2a591bf6fd41fd14bdae689aafac4a9ee702c23c
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/390aa4c9339bb0ec0bc8d554e830faf93ca9d49e
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/d3abaedf6a58469610136d2dace1a85cddf7afcf
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ecf67f1302f2080b4d241b973364aacda70ad740
416baaa9-dc9f-4396-8d5f-8c081fb06d67
https://git.kernel.org/stable/c/ee781058cd4d71e4449f41cbe6a3b8c59daa2c51
416baaa9-dc9f-4396-8d5f-8c081fb06d67