PT-2024-29743 · Linux+2 · Linux Kernel+2
Published
2024-06-24
·
Updated
2024-12-12
·
CVE-2024-42088
CVSS v3.1
7.8
High
| Vector | AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel (affected versions not specified)
Description
A vulnerability in the Linux kernel has been resolved. The issue is related to the ASoC (Audio System on Chip) component, specifically the mediatek mt8195 driver. A commit removed the codec entry for the ETDM1 OUT BE dai link entirely instead of replacing it with COMP EMPTY(), causing the remaining COMP EMPTY() platform entry to become the codec entry. This results in a KASAN out-of-bounds warning in the mtk soundcard common probe() function. The warning occurs because the code expects the platforms array to have space for at least one entry. To fix this, an COMP EMPTY() entry needs to be added so that dai link->platforms has space.
Recommendations
At the moment, there is no information about a newer version that contains a fix for this vulnerability.
Exploit
Improper Validation of Array Index
Found an issue in the description? Have something to add? Feel free to write us 👾
Related Identifiers
Affected Products
Linuxmint
Linux Kernel
Ubuntu