In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards harder
Since commit 13f58267cda3 ("ASoC: soc.h: don't create dummy Component via COMP_DUMMY()") dummy codecs declared like this:
SNDSOCDAILINKDEF(dummy, DAILINKCOMPARRAY(COMPDUMMY()));
expand to:
static struct sndsocdailinkcomponent dummy[] = { };
Which means that dummy is a zero sized array and thus dais[i].codecs should not be dereferenced at all since it points to the address of the next variable stored in the data section as the "dummy" variable has an address but no size, so even dereferencing dais[0] is already an out of bounds array reference.
Which means that the if (dais[i].codecs->name) check added in commit 7d99a70b6595 ("ASoC: Intel: Boards: Fix NULL pointer deref in BYT/CHT boards") relies on that the part of the next variable which the name member maps to just happens to be NULL.
Which apparently so far it usually is, except when it isn't and then it results in crashes like this one:
[ 28.795659] BUG: unable to handle page fault for address: 0000000000030011 ... [ 28.795780] Call Trace: [ 28.795787] <TASK> ... [ 28.795862] ? strcmp+0x18/0x40 [ 28.795872] 0xffffffffc150c605 [ 28.795887] platformprobe+0x40/0xa0 ... [ 28.795979] ? _pfxinitmodule+0x10/0x10 [sndsocsstbytcrwm5102]
Really fix things this time around by checking dais.num_codecs != 0.
[
{
"id": "CVE-2024-46793-095d46d5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5640.c"
},
"digest": {
"line_hashes": [
"30362143109826806589873273688922881831",
"49062319377920326767104002125223218058",
"310158525480867143889805691640458891298",
"34991249814192683816565020013899623799"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-106a026d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_da7213.c",
"function": "bytcht_da7213_probe"
},
"digest": {
"function_hash": "125814557936338041172908023086497909122",
"length": 1239.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-155e37ad",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_wm5102.c",
"function": "snd_byt_wm5102_mc_probe"
},
"digest": {
"function_hash": "11647194672854080873813396408021920945",
"length": 2942.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-1743b776",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5672.c"
},
"digest": {
"line_hashes": [
"189878124212713230579318646562537267994",
"210249237195936036667120534418134120547",
"281865158300384297172205788690864702908",
"104818609011920160441981413170969096615"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-17b8c18d",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5651.c"
},
"digest": {
"line_hashes": [
"13822100066957878631505153574331286134",
"184657744044831351064656775271965420848",
"6512524805102768870915035941927449767",
"253341361302462668380991183736374027806"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-17be79d2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bxt_rt298.c"
},
"digest": {
"line_hashes": [
"326875161369879836217381922108625066515",
"305851279542062151744792478198497762243",
"296141274152566141362215299791773234276",
"334538499215603687358149629891836150403"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-1eb57ebf",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_da7213.c"
},
"digest": {
"line_hashes": [
"191721620372481205746922398562633342743",
"283488331378603927427226969866868224404",
"98423875967809388092363845450040894454",
"69262363204547867940482074562851991473"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-1f773dd8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_cx2072x.c",
"function": "snd_byt_cht_cx2072x_probe"
},
"digest": {
"function_hash": "238600392242176884615718574735212323522",
"length": 1126.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-294ff1b5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5640.c",
"function": "snd_byt_rt5640_mc_probe"
},
"digest": {
"function_hash": "8362658915575032891345295703795710543",
"length": 5546.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-34a847b5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_da7213.c",
"function": "bytcht_da7213_probe"
},
"digest": {
"function_hash": "125814557936338041172908023086497909122",
"length": 1239.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-3cc5760a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bxt_rt298.c",
"function": "broxton_audio_probe"
},
"digest": {
"function_hash": "96069369954092243452528969165156307107",
"length": 1206.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-4f8f0d07",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5640.c",
"function": "snd_byt_rt5640_mc_probe"
},
"digest": {
"function_hash": "8362658915575032891345295703795710543",
"length": 5546.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-52fec28a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_es8316.c"
},
"digest": {
"line_hashes": [
"250541292483581767832997449084768270612",
"73719711029451800798720296173573127826",
"291774222565743475943788464345426447930",
"114442871067940796349965268896177142625"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-59142464",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5640.c"
},
"digest": {
"line_hashes": [
"30362143109826806589873273688922881831",
"49062319377920326767104002125223218058",
"310158525480867143889805691640458891298",
"34991249814192683816565020013899623799"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-676babad",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5651.c"
},
"digest": {
"line_hashes": [
"13822100066957878631505153574331286134",
"184657744044831351064656775271965420848",
"6512524805102768870915035941927449767",
"253341361302462668380991183736374027806"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-69f0d0ab",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bxt_rt298.c"
},
"digest": {
"line_hashes": [
"326875161369879836217381922108625066515",
"305851279542062151744792478198497762243",
"296141274152566141362215299791773234276",
"334538499215603687358149629891836150403"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-6f5bf146",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bxt_rt298.c",
"function": "broxton_audio_probe"
},
"digest": {
"function_hash": "96069369954092243452528969165156307107",
"length": 1206.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-77743749",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_cx2072x.c"
},
"digest": {
"line_hashes": [
"217846763909718379178186000620841943584",
"163339535332069313145321259834297975081",
"284967401275878307801574775555154072469",
"218348052566069720820216620663121982057"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-939785a7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5645.c",
"function": "snd_cht_mc_probe"
},
"digest": {
"function_hash": "112928490089427871143431062145801998170",
"length": 4001.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-a1b3f052",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_wm5102.c"
},
"digest": {
"line_hashes": [
"30160502422003986144852975217196555843",
"51958893338814853831491071671429698183",
"210367369470645746765735042824341939364",
"11140863884349079750511038236579914539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-a84816e5",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5672.c"
},
"digest": {
"line_hashes": [
"189878124212713230579318646562537267994",
"210249237195936036667120534418134120547",
"281865158300384297172205788690864702908",
"104818609011920160441981413170969096615"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-bedde07e",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_es8316.c",
"function": "snd_byt_cht_es8316_mc_probe"
},
"digest": {
"function_hash": "234976461697093325730090812469006233151",
"length": 4073.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-c418d325",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_es8316.c"
},
"digest": {
"line_hashes": [
"250541292483581767832997449084768270612",
"73719711029451800798720296173573127826",
"291774222565743475943788464345426447930",
"114442871067940796349965268896177142625"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-c557123a",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5651.c",
"function": "snd_byt_rt5651_mc_probe"
},
"digest": {
"function_hash": "273062974606412347266819297774397607215",
"length": 5183.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-c5c0305f",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_cx2072x.c",
"function": "snd_byt_cht_cx2072x_probe"
},
"digest": {
"function_hash": "238600392242176884615718574735212323522",
"length": 1126.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-cfa11bb1",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_cx2072x.c"
},
"digest": {
"line_hashes": [
"217846763909718379178186000620841943584",
"163339535332069313145321259834297975081",
"284967401275878307801574775555154072469",
"218348052566069720820216620663121982057"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-d3ec07b8",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5645.c"
},
"digest": {
"line_hashes": [
"94327274244509404516479276000360600616",
"43518023547911677314729046681248246974",
"295114874630334272558375177667540503915",
"242007380644823054407835816484467041430"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-de51e1fd",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_wm5102.c",
"function": "snd_byt_wm5102_mc_probe"
},
"digest": {
"function_hash": "11647194672854080873813396408021920945",
"length": 2942.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-df029575",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5672.c",
"function": "snd_cht_mc_probe"
},
"digest": {
"function_hash": "148543510848686928174302338425039866165",
"length": 1921.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-e0b89f29",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcht_es8316.c",
"function": "snd_byt_cht_es8316_mc_probe"
},
"digest": {
"function_hash": "234976461697093325730090812469006233151",
"length": 4073.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-e7af2737",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5645.c"
},
"digest": {
"line_hashes": [
"94327274244509404516479276000360600616",
"43518023547911677314729046681248246974",
"295114874630334272558375177667540503915",
"242007380644823054407835816484467041430"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-e7d74440",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/bytcr_rt5651.c",
"function": "snd_byt_rt5651_mc_probe"
},
"digest": {
"function_hash": "273062974606412347266819297774397607215",
"length": 5183.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-e95ed7f0",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5672.c",
"function": "snd_cht_mc_probe"
},
"digest": {
"function_hash": "148543510848686928174302338425039866165",
"length": 1921.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0cc65482f5b03ac2b1c240bc34665e43ea2d71bb"
},
{
"id": "CVE-2024-46793-ed2b1ec2",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcr_wm5102.c"
},
"digest": {
"line_hashes": [
"30160502422003986144852975217196555843",
"51958893338814853831491071671429698183",
"210367369470645746765735042824341939364",
"11140863884349079750511038236579914539"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-f704f022",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Function",
"target": {
"file": "sound/soc/intel/boards/cht_bsw_rt5645.c",
"function": "snd_cht_mc_probe"
},
"digest": {
"function_hash": "112928490089427871143431062145801998170",
"length": 4001.0
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
},
{
"id": "CVE-2024-46793-ff988db7",
"deprecated": false,
"signature_version": "v1",
"signature_type": "Line",
"target": {
"file": "sound/soc/intel/boards/bytcht_da7213.c"
},
"digest": {
"line_hashes": [
"191721620372481205746922398562633342743",
"283488331378603927427226969866868224404",
"98423875967809388092363845450040894454",
"69262363204547867940482074562851991473"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@85cda5b040bda9c577b34eb72d5b2e5b7e31985c"
}
]