PT-2026-64704 · Linux · Linux

CVE-2026-64483

·

Publicado

2026-07-25

·

Atualizado

2026-07-25

Nenhuma

Não há classificações de severidade ou métricas disponíveis. Quando houver, atualizaremos as informações correspondentes na página.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: firewire: isight: bound the sample count to the packet payload
isight packet() takes the frame count from the device iso packet and checks it only against the device claimed iso length.
count = be32 to cpu(payload->sample count);
if (likely(count <= (length - 16) / 4))
	isight samples(isight, payload->samples, count);
length is the iso header data length. It can be up to 0xffff. So the gate allows a count up to about 16379. isight samples() then copies count frames out of payload->samples into the PCM DMA buffer.
payload->samples holds only 2 * MAX FRAMES PER PACKET values. The device multiplexes two samples per frame. A count past MAX FRAMES PER PACKET reads past the payload. A count past the buffer size writes past runtime->dma area. The smallest PCM buffer is larger than MAX FRAMES PER PACKET. Bounding the count to MAX FRAMES PER PACKET keeps both the read and the write in range.
A malicious or faulty Apple iSight on the FireWire bus reaches this during a normal capture.
Add the MAX FRAMES PER PACKET bound to the gate.
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

CVE-2026-64483

Produtos afetados

Linux