CVE-2024-42238: firmware: cs_dsp: Return error if block header overflows file
firmware: csdsp: Return error if block header overflows file
Other sources
Linux Kernel is vulnerable to a buffer overflow, caused by improper bounds checking in csdsppowerup(). By sending a specially crafted request, a remote attacker could overflow to cause a denial of service.
— IBM
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
debian/linux-6.1to a version that resolves this vulnerability.Fixed in 6.1.129-1~deb11u1 - Compensating control
Modify firmware cs_dsp_power_up() to return an error when a block header is longer than the amount of data remaining in the file, aborting file processing instead of continuing.
Event History
Frequently Asked Questions
What is the severity of CVE-2024-42238?
CVE-2024-42238 has a severity rating that reflects a moderate level of impact on system stability and security, particularly in the handling of block headers.
How do I fix CVE-2024-42238?
To fix CVE-2024-42238, update to a patched version of the Linux kernel, specifically versions like 5.10.223-1, 6.1.123-1, or later releases.
Which versions of the Linux kernel are affected by CVE-2024-42238?
CVE-2024-42238 affects Linux kernel versions from 5.16 up to 6.1.100, 6.2 up to 6.6.41, and 6.7 up to 6.9.10.
What component of the Linux kernel is involved in CVE-2024-42238?
CVE-2024-42238 involves the cs_dsp component of the Linux kernel, specifically in the functions cs_dsp_power_up() and cs_dsp_load().
Is CVE-2024-42238 a denial of service vulnerability?
CVE-2024-42238 is not classified as a denial of service vulnerability, but could lead to improper error handling in certain scenarios.