CVE-2024-42237

firmware: cs_dsp: Validate payload length before processing block

published August 7, 2024

CVSS
—
EPSS
0%
Percentile
10.9
In the wild
Unconfirmed
What it is

In the Linux kernel, the following vulnerability has been resolved:

firmware: cs_dsp: Validate payload length before processing block

Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load()

to be done before the block is processed.

The check that the length of a block payload does not exceed the number

of remaining bytes in the firwmware file buffer was being done near the

end of the loop iteration. However, some code before that check used the

length field without validating it.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.00211 · 10.9th percentile
Published
2024-08-07T15:14Z
EPSS history
Timeline
  • 07 AUG 15:14Z
    firmware: cs_dsp: Validate payload length before processing block
    cvelistv5