CVE-2024-42097: ALSA: emux: improve patch ioctl data validation
In the Linux kernel, the following vulnerability has been resolved:
ALSA: emux: improve patch ioctl data validation
In loaddata(), make the validation of and skipping over the main info block match that in loadguspatch().
In loadguspatch(), add checking that the specified patch length matches the actually supplied data, like loaddata() already did.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42097?
CVE-2024-42097 is classified as a high severity vulnerability due to its potential impact on system stability and security.
How do I fix CVE-2024-42097?
To fix CVE-2024-42097, update your Linux kernel to the patched versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.119-1, 6.12.11-1, or 6.12.12-1.
Which versions of Linux are affected by CVE-2024-42097?
CVE-2024-42097 affects specific versions of the Linux kernel, including various releases within the 5.10 and 6.1 series.
What components of Linux are impacted by CVE-2024-42097?
CVE-2024-42097 impacts the ALSA (Advanced Linux Sound Architecture) component, specifically the emux driver.
Is there a workaround for CVE-2024-42097?
There currently are no documented workarounds for CVE-2024-42097, thus applying the security patch is the recommended action.