Richard Fitzgerald

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to insufficient input validation in the `cs dsp coeff parse alg()` and `cs dsp coeff parse coeff()` functions in the Linux kernel's `cs dsp` component. This can lead to a denial of service. The vulnerability is resolved by using `strnlen()` instead of `strlen()` on the algorithm and coefficient name string arrays in V1 wmfw files to prevent overrunning the array if the NUL terminator is missing. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Linux kernel (affected versions not specified) Description: The issue is related to the validation of payload length in the cs dsp module of the Linux kernel. Specifically, the check for the length of a block payload was being done near the end of the loop iteration, but some code before that check used the length field without validating it. This could potentially allow an attacker to cause a denial of service. The functions `cs dsp load()` and `cs dsp coeff load()` are involved in this issue. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a buffer overrun when processing V2 algorithm headers in the Linux kernel's firmware, specifically in the cs dsp module. The wmfw V2 format introduces variable-length strings in the algorithm block header, making the overall header length variable and the position of most fields dependent on the length of the string fields. Each field must be checked to ensure it does not overflow the firmware data buffer. The vulnerability can be exploited to cause a denial of service. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to a buffer overflow vulnerability in the Linux kernel, specifically in the cs dsp function. The vulnerability occurs when the firmware file buffer is not large enough for the wmfw header, allowing an attacker to potentially impact the confidentiality, integrity, and availability of protected information. The original code did not properly check the length of the firmware data buffer, which could lead to overrunning the buffer. The patch splits the length check into three separate parts, checking the `wmfw header`, `wmfw adsp? sizes`, and `wmfw footer` separately before they are used. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the ALSA controls in the Linux kernel, specifically with the `hda/cs dsp ctl` module. The original implementation did not properly remove the ALSA controls when the amp driver was removed or unloaded, leading to potential memory leaks and segfaults. The `private free` callback is used to free the associated data block, ensuring that memory is not leaked. Attempting to access the remaining ALSA controls could cause errors, including segfaults or dereferencing stale pointers. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Linux kernel (affected versions not specified) **Description** The issue is related to the `regcache maple drop()` function in the Linux kernel's regmap module, specifically in the `drivers/base/regmap/regcache-maple.c` file. It involves an out-of-bounds access that copies part of the kernel memory over the cache contents. This occurs because the code indexes the `entry[]` array by only the register address, instead of using the offset from the base register of the block, i.e., `max - mas.index`. The bug was not detected by the regmap KUnit test because it only tests with a block of registers starting at 0, resulting in `mas.index == 0`. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.