In the Linux kernel, the following vulnerability has been resolved:
ALSA: asihpi: Fix potential OOB array access
ASIHPI driver stores some values in the static array upon a response from the driver, and its index depends on the firmware. We shouldn't trust it blindly.
This patch adds a sanity check of the array index to fit in the array size.
[ { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e658227d9d4f4e122d81690fdbc0d438b10288f5", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-070a4c02" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a55740996701f7b2bc46dc988b60ef2e416a747", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-08c229cd" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad7248a5e92587b9266c62db8bcc4e58de53e372", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-0c38a8a4" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36ee4021bcc37b834996e79740d095d6f8dd948f", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-11d0f3a7" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6bdb691cf7b66dcd929de1a253c5c42edd2e522", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-1e90d141" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e658227d9d4f4e122d81690fdbc0d438b10288f5", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-43c018b4" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce2953e44829ec54bcbb57e9d890fc8af0900c80", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-4ab372a6" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876d04bf5a8ac1d6af5afd258cd37ab83ab2cf3d", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-71337a25" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ce2953e44829ec54bcbb57e9d890fc8af0900c80", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-7fdf0d13" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@219587bca2678e31700ef09ecec178ba1f735674", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-8abbc82d" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@876d04bf5a8ac1d6af5afd258cd37ab83ab2cf3d", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-9152edcd" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@36ee4021bcc37b834996e79740d095d6f8dd948f", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-a4a45bf0" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@ad7248a5e92587b9266c62db8bcc4e58de53e372", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-af58800a" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@219587bca2678e31700ef09ecec178ba1f735674", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-b1fb24f3" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b986c7430a6bb68d523dac7bfc74cbd5b44ef96", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-b3641465" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a55740996701f7b2bc46dc988b60ef2e416a747", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-d2d6b922" }, { "signature_type": "Line", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7b986c7430a6bb68d523dac7bfc74cbd5b44ef96", "signature_version": "v1", "target": { "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "threshold": 0.9, "line_hashes": [ "275233182495619707069477428833672466377", "208171545952689773888834920169605799581", "217029191036781811126383511345669633754", "75755583318239550745933587197615249221" ] }, "id": "CVE-2024-50007-ee96813e" }, { "signature_type": "Function", "deprecated": false, "source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a6bdb691cf7b66dcd929de1a253c5c42edd2e522", "signature_version": "v1", "target": { "function": "HPIMSGX__init", "file": "sound/pci/asihpi/hpimsgx.c" }, "digest": { "function_hash": "274986544377690749182611010868598580970", "length": 682.0 }, "id": "CVE-2024-50007-f9c8b22c" } ]