CVE-2022-49518: ASoC: SOF: ipc3-topology: Correct get_control_data for non bytes payload
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc3-topology: Correct getcontroldata for non bytes payload
It is possible to craft a topology where sofgetcontroldata() would do out of bounds access because it expects that it is only called when the payload is bytes type. Confusingly it also handles other types of controls, but the payload parsing implementation is only valid for bytes.
Fix the code to count the non bytes controls and instead of storing a pointer to sofabihdr in sofwidgetdata (which is only valid for bytes), store the pointer to the data itself and add a new member to save the size of the data.
In case of non bytes controls we store the pointer to the chanv itself, which is just an array of values at the end.
In case of bytes control, drop the wrong cdata->data (wdata[i].pdata) check against NULL since it is incorrect and invalid in this context. The data is pointing to the end of cdata struct, so it should never be null.
Affected Software
Event History
Frequently Asked Questions
What access does an attacker need to exploit this issue?
The CVSS vector indicates local access, low attack complexity, and low privileges required. No user interaction is required.
What impact could successful exploitation have?
The reported impacts are high confidentiality impact and high availability impact, with no integrity impact. The underlying flaw is an out-of-bounds access when a crafted topology causes non-bytes control payloads to be parsed as bytes.
What configuration or input is involved?
Exploitation requires a crafted SOF topology containing non-bytes controls that reach sof_get_control_data(). The vulnerable parsing logic assumes the function is called only for bytes payloads, even though it also handles other control types.
Are fixed versions identified in the available information?
No fixed Linux kernel version is provided. Two stable kernel commit references are supplied: 896b03bb7c7010042786cfae2115083d4c241dd3 and a962890a5a3cce903ff7c7a19fadee63ed9efdc7.