CVE-2024-53045: ASoC: dapm: fix bounds checker error in dapm_widget_list_create
In the Linux kernel, the following vulnerability has been resolved:
ASoC: dapm: fix bounds checker error in dapmwidgetlistcreate
The widgets array in the sndsocdapmwidgetlist has a countedby attribute attached to it, which points to the numwidgets variable. This attribute is used in bounds checking, and if it is not set before the array is filled, then the bounds sanitizer will issue a warning or a kernel panic if CONFIGUBSANTRAP is set.
This patch sets the size of the widgets list calculated with listforeach as the initial value for numwidgets as it is used for allocating memory for the array. It is updated with the actual number of added elements after the array is filled.
Other sources
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-53045?
CVE-2024-53045 has been classified with a medium severity rating due to its potential impact on kernel stability.
How do I fix CVE-2024-53045?
To fix CVE-2024-53045, upgrade to the latest stable version of the Linux kernel that addresses this vulnerability.
What versions of the Linux kernel are affected by CVE-2024-53045?
CVE-2024-53045 affects Linux kernel versions from 6.7 up to 6.11.7 and several 6.12 release candidates.
What is the impact of CVE-2024-53045?
The impact of CVE-2024-53045 may include reliability issues due to a bounds checker error in the dapm_widget_list.
Is there a workaround for CVE-2024-53045?
There are currently no known workarounds for CVE-2024-53045 other than applying the security patch by upgrading the kernel.