| From bippy-5f407fcff5a0 Mon Sep 17 00:00:00 2001 |
| From: Greg Kroah-Hartman <gregkh@linuxfoundation.org> |
| To: <linux-cve-announce@vger.kernel.org> |
| Reply-to: <cve@kernel.org>, <linux-kernel@vger.kernel.org> |
| Subject: CVE-2021-47650: ASoC: soc-compress: prevent the potentially use of null pointer |
| |
| Description |
| =========== |
| |
| In the Linux kernel, the following vulnerability has been resolved: |
| |
| ASoC: soc-compress: prevent the potentially use of null pointer |
| |
| There is one call trace that snd_soc_register_card() |
| ->snd_soc_bind_card()->soc_init_pcm_runtime() |
| ->snd_soc_dai_compress_new()->snd_soc_new_compress(). |
| In the trace the 'codec_dai' transfers from card->dai_link, |
| and we can see from the snd_soc_add_pcm_runtime() in |
| snd_soc_bind_card() that, if value of card->dai_link->num_codecs |
| is 0, then 'codec_dai' could be null pointer caused |
| by index out of bound in 'asoc_rtd_to_codec(rtd, 0)'. |
| And snd_soc_register_card() is called by various platforms. |
| Therefore, it is better to add the check in the case of misusing. |
| And because 'cpu_dai' has already checked in soc_init_pcm_runtime(), |
| there is no need to check again. |
| Adding the check as follow, then if 'codec_dai' is null, |
| snd_soc_new_compress() will not pass through the check |
| 'if (playback + capture != 1)', avoiding the leftover use of |
| 'codec_dai'. |
| |
| The Linux kernel CVE team has assigned CVE-2021-47650 to this issue. |
| |
| |
| Affected and fixed versions |
| =========================== |
| |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.4.189 with commit 68a69ad8df959e5211ed4a8e120783b2d352ea74 |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.10.110 with commit 4639c1d97f385f4784f44d66a3da0672f4951ada |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.15.33 with commit fc237b8d624f4bcb0f21a532627ce4e3b3a85569 |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.16.19 with commit 08af6da684b44097ea09f1d74d5858b837ed203b |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.17.2 with commit f69a75cb8a98c6c487d620442c68595726a69f60 |
| Issue introduced in 5.4 with commit 467fece8fbc6774a3a3bd0981e1a342fb5022706 and fixed in 5.18 with commit de2c6f98817fa5decb9b7d3b3a8a3ab864c10588 |
| |
| Please see https://www.kernel.org for a full list of currently supported |
| kernel versions by the kernel community. |
| |
| Unaffected versions might change over time as fixes are backported to |
| older supported kernel versions. The official CVE entry at |
| https://cve.org/CVERecord/?id=CVE-2021-47650 |
| will be updated if fixes are backported, please check that for the most |
| up to date information about this issue. |
| |
| |
| Affected files |
| ============== |
| |
| The file(s) affected by this issue are: |
| sound/soc/soc-compress.c |
| |
| |
| Mitigation |
| ========== |
| |
| The Linux kernel CVE team recommends that you update to the latest |
| stable kernel version for this, and many other bugfixes. Individual |
| changes are never tested alone, but rather are part of a larger kernel |
| release. Cherry-picking individual commits is not recommended or |
| supported by the Linux kernel community at all. If however, updating to |
| the latest release is impossible, the individual changes to resolve this |
| issue can be found at these commits: |
| https://git.kernel.org/stable/c/68a69ad8df959e5211ed4a8e120783b2d352ea74 |
| https://git.kernel.org/stable/c/4639c1d97f385f4784f44d66a3da0672f4951ada |
| https://git.kernel.org/stable/c/fc237b8d624f4bcb0f21a532627ce4e3b3a85569 |
| https://git.kernel.org/stable/c/08af6da684b44097ea09f1d74d5858b837ed203b |
| https://git.kernel.org/stable/c/f69a75cb8a98c6c487d620442c68595726a69f60 |
| https://git.kernel.org/stable/c/de2c6f98817fa5decb9b7d3b3a8a3ab864c10588 |
