CVE-2024-26927: ASoC: SOF: Add some bounds checking to firmware data
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
Smatch complains about "head->fullsize - head->headersize" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
The Linux kernel CVE team has assigned CVE-2024-26927 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024042844-CVE-2024-26927-3374@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.83 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.23 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.11 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.9 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.85 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.26 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8.5 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.85-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.7.12-1 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26927?
The severity of CVE-2024-26927 is categorized as moderate due to potential data integrity issues.
How do I fix CVE-2024-26927?
To fix CVE-2024-26927, you should update the Linux kernel to version 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9, 6.8.5, or apply the relevant updates for Debian packages.
Which software is affected by CVE-2024-26927?
CVE-2024-26927 affects various versions of the Linux kernel, specifically those below the patched versions.
What is the impact of CVE-2024-26927 on system security?
CVE-2024-26927 could lead to vulnerabilities where firmware data could be manipulated, affecting system stability and security.
Is CVE-2024-26927 exploitative under certain conditions?
Yes, CVE-2024-26927 can be potentially exploited if an attacker can provide malicious firmware to the affected systems.