CVE-2024-27436: ALSA: usb-audio: Stop parsing channels bits when all channels are found.
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
If a usb audio device sets more bits than the amount of channels it could write outside of the map array.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: usb-audio: Stop parsing channels bits when all channels are found.
The Linux kernel CVE team has assigned CVE-2024-27436 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051711-CVE-2024-27436-2227@gregkh/T
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27436?
CVE-2024-27436 has been classified with a moderate severity due to its potential to cause out-of-bounds writes in the Linux kernel.
How do I fix CVE-2024-27436?
To fix CVE-2024-27436, update your kernel to one of the following versions: 4.19.311, 5.4.273, 5.10.214, 5.15.153, 6.1.83, 6.6.23, 6.7.11, 6.8.2, 6.9, or the latest patched version.
Which Linux distributions are affected by CVE-2024-27436?
CVE-2024-27436 affects the Red Hat and Debian distributions that utilize vulnerable kernel versions before the specified patched versions.
What are the potential impacts of CVE-2024-27436?
The impact of CVE-2024-27436 includes possible out-of-bounds memory access leading to system instability or security breaches.
Is there a known exploit for CVE-2024-27436?
As of now, there are no publicly known exploits specifically targeting CVE-2024-27436.