CVE-2024-41039: firmware: cs_dsp: Fix overflow checking of wmfw header
In the Linux kernel, the following vulnerability has been resolved:
firmware: csdsp: Fix overflow checking of wmfw header
Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer.
The original code tested that the firmware data buffer contained enough bytes for the sums of the size of the structs
wmfwheader + wmfwadsp1sizes + wmfwfooter
But wmfwadsp1sizes is only used on ADSP1 firmware. For ADSP2 and Halo Core the equivalent struct is wmfwadsp2sizes, which is 4 bytes longer. So the length check didn't guarantee that there are enough bytes in the firmware buffer for a header with wmfwadsp2sizes.
This patch splits the length check into three separate parts. Each of the wmfwheader, wmfwadsp?sizes and wmfwfooter are checked separately before they are used.
Other sources
Linux Kernel is vulnerable to a stack-based buffer overflow, caused by improper bounds checking by the wmfw header. By sending a specially crafted request, a local authenticated attacker could overflow a buffer and execute arbitrary code on the system.
— IBM
This CVE was automatically created from a reference found in an email or other text. If you are reading this, then this CVE entry is probably erroneous, since this text should be replaced by the official CVE description automatically.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41039?
The severity of CVE-2024-41039 is classified as medium due to potential buffer overflow risks.
How do I fix CVE-2024-41039?
To fix CVE-2024-41039, update your kernel to version 6.1.100, 6.6.41, 6.9.10, or 6.10 based on your operating system.
Which versions of the Linux kernel are affected by CVE-2024-41039?
CVE-2024-41039 affects Linux kernel versions from 5.16 up to 6.1.100, 6.2 to 6.6.41, 6.7 to 6.9.10, and specific 6.10 release candidates.
What types of systems are vulnerable to CVE-2024-41039?
Systems running affected versions of the Linux kernel, particularly those using the cs_dsp firmware, are vulnerable to CVE-2024-41039.
Is there a workaround for CVE-2024-41039?
There is no known workaround for CVE-2024-41039; updating the kernel is the recommended approach to mitigate the vulnerability.