CVE-2024-42088: ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link
In the Linux kernel, the following vulnerability has been resolved:
ASoC: mediatek: mt8195: Add platform entry for ETDM1OUTBE dai link
Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") removed the codec entry for the ETDM1OUTBE dai link entirely instead of replacing it with COMPEMPTY(). This worked by accident as the remaining COMPEMPTY() platform entry became the codec entry, and the platform entry became completely empty, effectively the same as COMPDUMMY() since sndsocfilldummydai() doesn't do anything for platform entries.
This causes a KASAN out-of-bounds warning in mtksoundcardcommonprobe() in sound/soc/mediatek/common/mtk-soundcard-driver.c:
foreachcardprelinks(card, i, dailink) { if (adspnode && !strncmp(dailink->name, "AFESOF", strlen("AFESOF"))) dailink->platforms->ofnode = adspnode; else if (!dailink->platforms->name && !dailink->platforms->ofnode) dailink->platforms->ofnode = platformnode; }
where the code expects the platforms array to have space for at least one entry.
Add an COMPEMPTY() entry so that dailink->platforms has space.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel (ASoC: mediatek: mt8195)to a version that resolves this vulnerability.Patch e70b8dd26711 - Configuration
Apply the fix that reintroduces capacity for the ETDM1_OUT_BE dai link by adding a COMP_EMPTY() platform entry (so dai_link->platforms has space for at least one element). This prevents KASAN out-of-bounds warning in mtk_soundcard_common_probe() where the code dereferences dai_link->platforms->of_node and expects platforms to contain an entry.
Linux kernel ASoC (sound/soc/mediatek/common/mtk-soundcard-driver.c) dai_link->platforms array has space via COMP_EMPTY() entry = Add a COMP_EMPTY() entry for the ETDM1_OUT_BE dai link so dai_link->platforms has at least one entry (instead of removing the codec entry entirely)
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42088?
CVE-2024-42088 has a low severity rating as it primarily involves a modification in the Linux kernel's audio driver configuration.
How do I fix CVE-2024-42088?
To fix CVE-2024-42088, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.15-1.
What systems are affected by CVE-2024-42088?
CVE-2024-42088 affects specific versions of the Linux kernel used in Debian and potentially other distributions.
What is the nature of CVE-2024-42088?
CVE-2024-42088 involves a rework of the codec link for audio drivers in the Linux kernel, specifically for the Mediatek mt8195 platform.
What do I need to do after fixing CVE-2024-42088?
After fixing CVE-2024-42088, ensure to test audio functionalities to confirm proper operation with the updated kernel.