Linux: ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
What fixes it
- 5e1322787c5e424a570e87c8c2c25e37552cbe3bLinuxCVE List
- 746de48c3a250f0c264105dcbfcdf0c5001e970bLinuxCVE List
A fixed version on one release line is not the upgrade target for every line. Check your exact version and any vendor backports.
Description
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-topology: Fix shift-out-of-bounds for aggregated ALH capture
When ch_count is smaller than blob->alh_cfg.device_count (e.g. a mono capture stream, such as a SmartMic, aggregated across multiple SDW links), step = ch_count / blob->alh_cfg.device_count truncates to 0. The subsequent GENMASK(step - 1, 0) then underflows step - 1 (u32) to UINT_MAX, causing GENMASK()'s internal shift to use an out-of-bounds exponent:
UBSAN: shift-out-of-bounds in sound/soc/sof/ipc4-topology.c:2363:13 shift exponent 18446744069414584384 is too large for 64-bit type 'long unsigned int'
Treat ch_count < device_count the same way as the existing "channels equal to output reference channels" case: apply the same ch_mask to every aggregated device instead of trying to split channels that can't be evenly divided.
Text from CVE List
Affected versions 8
- Linuxaffected: 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c before cad63a7798d6a6cac1fc68732595f0a3278ff6f0CVE List
- Linuxaffected: 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c before 5e1322787c5e424a570e87c8c2c25e37552cbe3bCVE List
- Linuxaffected: 0390a102cc18cb7456d6c1f15ac51f1af90fcf9c before 746de48c3a250f0c264105dcbfcdf0c5001e970bCVE List
- Linuxaffected: 6.3CVE List
- Linuxunaffected: all versions before 6.3CVE List
- Linuxunaffected: 6.18.59 through 6.18.*CVE List
- Linuxunaffected: 7.2.13 through 7.2.*CVE List
- Linuxunaffected: 7.3CVE List