NetSight
IP …
high8.4

CVE-2024-26927

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_siz…

Impact

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Add some bounds checking to firmware data Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 5.19 before 6.1.83
from 6.2 before 6.6.23
from 6.7 before 6.7.11
from 6.8 before 6.8.2

Weakness classification

CWE-120

References