ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.23 % · centile 14 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Rechercher sur…
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Reject out of bounds values in snd_soc_put_volsw() We don't currently validate that the values being set are within the range we advertised to userspace as being valid, do so and reject any values that are out of range.
Faiblesses (CWE)
- CWE-125 — Lecture hors limites
Références
- https://git.kernel.org/stable/c/40f598698129b5ceaf31012f9501b775c7b6e57d
- https://git.kernel.org/stable/c/586ef863c94354a7e00e5ae5ef01443d1dc99bc7
- https://git.kernel.org/stable/c/65a61b1f56f5386486757930069fbdce94af08bf
- https://git.kernel.org/stable/c/68fd718724284788fc5f379e0b7cac541429ece7
- https://git.kernel.org/stable/c/a9394f21fba027147bf275b083c77955864c366a
- https://git.kernel.org/stable/c/9e8895f1b3d4433f6d78aa6578e9db61ca6e6830
- https://git.kernel.org/stable/c/bb72d2dda85564c66d909108ea6903937a41679d
- https://git.kernel.org/stable/c/817f7c9335ec01e0f5e8caffc4f1dcd5e458a4c0
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | HIGH 7.1 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-53617
- GCVE · GCVE-0-2022-48738
Avis du CERT-FR
- CERTFR-2024-AVI-0693 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0578 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*< 4.9.300cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.10 < 4.14.265cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.15 < 4.19.228cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.20 < 5.4.178cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.5 < 5.10.99cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.11 < 5.15.22cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16 < 5.16.8cpe:2.3:o:linux:linux_kernel:5.17:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:5.17:rc2:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < 40f598698129b5ceaf31012f9501b775c7b6e57d ; affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < 586ef863c94354a7e00e5ae5ef01443d1dc99bc7 ; affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < 65a61b1f56f5386486757930069fbdce94af08bf ; affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < 68fd718724284788fc5f379e0b7cac541429ece7 ; affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < a9394f21fba027147bf275b083c77955864c366a ; affected f227b88f0fce5f9b82aa934f8829a741c2e06d82 < 9e8895f1b3d4433f6d78aa6578e9db61ca6e6830 |
| Linux · Linux | affected 3.15 ; unaffected 0 < 3.15 ; unaffected 4.9.300 ≤ 4.9.* ; unaffected 4.14.265 ≤ 4.14.* ; unaffected 4.19.228 ≤ 4.19.* ; unaffected 5.4.178 ≤ 5.4.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |