ASoC: ops: Fix bounds check for _sx controls (Linux Linux)
En bref
- Source
- NVD
- EPSS
- EPSS 0.24 % · centile 15 ()
- État
- PUBLISHED
- Publiée
- Mise à jour
- Attribuée par
- Linux
- Statut NVD
- Analyzed
Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: ops: Fix bounds check for _sx controls For _sx controls the semantics of the max field is not the usual one, max is the number of steps rather than the maximum value. This means that our check in snd_soc_put_volsw_sx() needs to just check against the maximum value.
Références
- https://git.kernel.org/stable/c/e46adadf19248d59af3aa6bc52e09115bf479bf7
- https://git.kernel.org/stable/c/4a95a49f26308782b4056401989ecd7768fda8fa
- https://git.kernel.org/stable/c/46bab25cc0230df60d1c02b651cc5640a14b08df
- https://git.kernel.org/stable/c/73dce3c1d48c4662bdf3ccbde1492c2cb4bfd8ce
- https://git.kernel.org/stable/c/b50c9641897274c3faef5f95ac852f54b94be2e8
- https://git.kernel.org/stable/c/98b15c706644bebc19d2e77ccc360cc51444f6d0
- https://git.kernel.org/stable/c/325d94d16e3131b54bdf07356e4cd855e0d853fc
- https://git.kernel.org/stable/c/698813ba8c580efb356ace8dbf55f61dac6063a8
Scores
| Version | Score | Vecteur | Évalué par |
|---|---|---|---|
| CVSS 3.1 | MEDIUM 5.5 | CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H | NVD · nvd@nist.gov (Primary) |
Références européennes
- ENISA EUVD · EUVD-2022-53889
- GCVE · GCVE-0-2022-49005
Avis du CERT-FR
- CERTFR-2025-AVI-1057 — Multiples vulnérabilités dans les produits VMware · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1102 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1048 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-1033 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
- CERTFR-2024-AVI-0999 — Multiples vulnérabilités dans le noyau Linux de SUSE · cert.ssi.gouv.fr
Configurations affectées (CPE NVD)
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.9.300 < 4.9.335cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.14.265 < 4.14.301cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 4.19.228 < 4.19.268cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.4.178 < 5.4.226cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.10.99 < 5.10.158cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.15.22 < 5.15.82cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.16.8 < 5.17cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*≥ 5.17 < 6.0.12cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:*cpe:2.3:o:linux:linux_kernel:6.1:rc7:*:*:*:*:*:*
Produits affectés
| Produit | Versions |
|---|---|
| Linux · Linux | affected 9e5c40b5706d8aae2cf70bd7e01f0b4575a642d0 < e46adadf19248d59af3aa6bc52e09115bf479bf7 ; affected 4977491e4b3aad8567f57e2a9992d251410c1db3 < 4a95a49f26308782b4056401989ecd7768fda8fa ; affected 9a12fcbf3c622f9bf6b110a873d62b0cba93972e < 46bab25cc0230df60d1c02b651cc5640a14b08df ; affected c33402b056de61104b6146dedbe138ca8d7ec62b < 73dce3c1d48c4662bdf3ccbde1492c2cb4bfd8ce ; affected 038f8b7caa74d29e020949a43ca368c93f6b29b9 < b50c9641897274c3faef5f95ac852f54b94be2e8 ; affected e8e07c5e25a29e2a6f119fd947f55d7a55eb8a13 < 98b15c706644bebc19d2e77ccc360cc51444f6d0 |
| Linux · Linux | affected 5.17 ; unaffected 0 < 5.17 ; unaffected 4.9.335 ≤ 4.9.* ; unaffected 4.14.301 ≤ 4.14.* ; unaffected 4.19.268 ≤ 4.19.* ; unaffected 5.4.226 ≤ 5.4.* |
Sources
| Source | Licence |
|---|---|
| CVE List (CVEProject cvelistV5) | CVE Program Terms of Use |
| EPSS (FIRST.org) | FIRST — attribution requested |
| ENISA EUVD | ENISA — reproduction authorised, source acknowledged |
| CERT-FR (ANSSI) | Licence Ouverte / Etalab 2.0 |
| NVD (NIST) via fkie-cad/nvd-json-data-feeds | Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD |