CVE-2024-41056: firmware: cs_dsp: Use strnlen() on name fields in V1 wmfw files
In the Linux kernel, the following vulnerability has been resolved:
firmware: csdsp: Use strnlen() on name fields in V1 wmfw files
Use strnlen() instead of strlen() on the algorithm and coefficient name string arrays in V1 wmfw files.
In V1 wmfw files the name is a NUL-terminated string in a fixed-size array. csdsp should protect against overrunning the array if the NUL terminator is missing.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-41056?
CVE-2024-41056 has been assessed as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-41056?
To resolve CVE-2024-41056, upgrade to the kernel versions 6.1.100, 6.6.41, 6.9.10, 6.10, or appropriate updates from Debian.
Which Linux kernel versions are affected by CVE-2024-41056?
CVE-2024-41056 affects kernel versions prior to 6.1.100, 6.6.41, 6.9.10, and 6.10.
What components are impacted by CVE-2024-41056?
CVE-2024-41056 specifically impacts the firmware handling in V1 wmfw files within the Linux kernel.
Are there any workarounds for CVE-2024-41056?
Currently, the recommended approach for CVE-2024-41056 is to apply the necessary kernel updates rather than relying on workarounds.