In validateclockselector of clock.c, there is a possible out of bounds read due to memory corruption. This could lead to local information disclosure with no additional execution privileges needed. User interaction is not needed for exploitation.
{
"severity": "High",
"types": [
"ID"
],
"fixes": [
"https://android.googlesource.com/kernel/common/+/f9aca4186aa3e257d966fd5b2e5a4557394358e7",
"https://android.googlesource.com/kernel/common/+/d0e1b23b5d6aeac552a7b1f3721c0a377b8f54cb"
],
"spl": "2025-04-05",
"vanir_signatures": [
{
"signature_type": "Function",
"id": "ASB-A-382239029-13c1b8db",
"target": {
"function": "validate_clock_source",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/d0e1b23b5d6aeac552a7b1f3721c0a377b8f54cb",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "ASB-A-382239029-4062e6d0",
"target": {
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/f9aca4186aa3e257d966fd5b2e5a4557394358e7",
"signature_version": "v1",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "ASB-A-382239029-5538be9e",
"target": {
"function": "validate_clock_multiplier",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/f9aca4186aa3e257d966fd5b2e5a4557394358e7",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "ASB-A-382239029-79ccc9e4",
"target": {
"function": "validate_clock_multiplier",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/d0e1b23b5d6aeac552a7b1f3721c0a377b8f54cb",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "ASB-A-382239029-87aec0fb",
"target": {
"function": "validate_clock_source",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/f9aca4186aa3e257d966fd5b2e5a4557394358e7",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
},
{
"signature_type": "Line",
"id": "ASB-A-382239029-c2cc85dd",
"target": {
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/d0e1b23b5d6aeac552a7b1f3721c0a377b8f54cb",
"signature_version": "v1",
"digest": {
"line_hashes": [
"265400977830982444295918294344149627393",
"171085873840617657274733885613391206196",
"82997789143412418524293536495802543461",
"125812141739208913212144361011428449281",
"53534113893816824882743326171284255687",
"31223010587888343773372201349606036635",
"109183856859433338318935067452231071640",
"93240069133706551160883144084831253247",
"24637483293542169037362240142467062455",
"42310106538543845895214824549317468123",
"70372097107003232583350646205985042588",
"44848510674293726028304985816668968447",
"331833405989284484880620199056643806100",
"235371844192433601046661857425643057091"
],
"threshold": 0.9
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "ASB-A-382239029-d6cf6e33",
"target": {
"function": "validate_clock_selector",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/f9aca4186aa3e257d966fd5b2e5a4557394358e7",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
},
{
"signature_type": "Function",
"id": "ASB-A-382239029-ef862746",
"target": {
"function": "validate_clock_selector",
"file": "sound/usb/clock.c"
},
"source": "https://partner-android.googlesource.com/kernel/common/+/d0e1b23b5d6aeac552a7b1f3721c0a377b8f54cb",
"signature_version": "v1",
"digest": {
"function_hash": "205785718781910012398978548638517445518",
"length": 147.0
},
"deprecated": false
}
]
}