CVE-2024-26927: ASoC: SOF: Add some bounds checking to firmware data
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
Smatch complains about "head->fullsize - head->headersize" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
The Linux kernel CVE team has assigned CVE-2024-26927 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024042844-CVE-2024-26927-3374@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-26927?
The severity of CVE-2024-26927 is categorized as moderate due to potential data integrity issues.
How do I fix CVE-2024-26927?
To fix CVE-2024-26927, you should update the Linux kernel to version 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9, 6.8.5, or apply the relevant updates for Debian packages.
Which software is affected by CVE-2024-26927?
CVE-2024-26927 affects various versions of the Linux kernel, specifically those below the patched versions.
What is the impact of CVE-2024-26927 on system security?
CVE-2024-26927 could lead to vulnerabilities where firmware data could be manipulated, affecting system stability and security.
Is CVE-2024-26927 exploitative under certain conditions?
Yes, CVE-2024-26927 can be potentially exploited if an attacker can provide malicious firmware to the affected systems.