In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Dec 5, 2024 | Apr 28, 2024 |
| Suse | — | Upgrade gfs2-kmp-defaultUpgrade dtb-caviumUpgrade dtb-alteraUpgrade dtb-exynosUpgrade kernel-rt-livepatchUpgrade ocfs2-kmp-azureUpgrade kernel-debugUpgrade dtb-renesasUpgrade kernel-defaultUpgrade gfs2-kmp-azureUpgrade kernel-default-base-rebuildUpgrade kernel-rt-develUpgrade kernel-sourceUpgrade dtb-nvidiaUpgrade kernel-obs-qaUpgrade kernel-rtUpgrade reiserfs-kmp-defaultUpgrade dlm-kmp-64kbUpgrade kernel-64kb-extraUpgrade kselftests-kmp-64kbUpgrade dtb-allwinnerUpgrade kernel-symsUpgrade dtb-mediatekUpgrade dtb-apmUpgrade kernel-kvmsmall-develUpgrade kselftests-kmp-defaultUpgrade dtb-rockchipUpgrade dtb-qcomUpgrade kernel-devel-rtUpgrade kernel-develUpgrade dtb-hisiliconUpgrade kernel-zfcpdumpUpgrade dtb-xilinxUpgrade kernel-default-vdsoUpgrade ocfs2-kmp-defaultUpgrade kernel-default-livepatch-develUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-64kb-develUpgrade reiserfs-kmp-azureUpgrade kernel-syms-azureUpgrade kernel-64kb-optionalUpgrade kernel-default-optionalUpgrade dtb-armUpgrade kernel-rt_debug-livepatch-develUpgrade cluster-md-kmp-rtUpgrade kernel-64kb-livepatch-develUpgrade dtb-lgUpgrade kernel-source-rtUpgrade kernel-64kbUpgrade kernel-azure-livepatch-develUpgrade dlm-kmp-rtUpgrade dlm-kmp-azureUpgrade kernel-default-livepatchUpgrade kernel-rt-optionalUpgrade gfs2-kmp-rtUpgrade dtb-amdUpgrade kernel-rt-extraUpgrade kernel-rt-livepatch-develUpgrade reiserfs-kmp-rtUpgrade kernel-azure-develUpgrade cluster-md-kmp-azureUpgrade kernel-debug-vdsoUpgrade dtb-broadcomUpgrade dtb-marvellUpgrade dtb-amazonUpgrade kernel-debug-livepatch-develUpgrade kernel-azureUpgrade kernel-default-develUpgrade kernel-azure-extraUpgrade kernel-rt-vdsoUpgrade dtb-sprdUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade reiserfs-kmp-64kbUpgrade kselftests-kmp-azureUpgrade kernel-syms-rtUpgrade kernel-source-azureUpgrade kernel-kvmsmallUpgrade kernel-docsUpgrade kernel-kvmsmall-livepatch-develUpgrade kselftests-kmp-rtUpgrade ocfs2-kmp-64kbUpgrade kernel-source-vanillaUpgrade dtb-freescaleUpgrade dtb-appleUpgrade cluster-md-kmp-defaultUpgrade cluster-md-kmp-64kbUpgrade kernel-devel-azureUpgrade kernel-default-baseUpgrade kernel-azure-optionalUpgrade kernel-rt_debug-vdsoUpgrade dtb-socionextUpgrade kernel-docs-htmlUpgrade kernel-rt_debugUpgrade kernel-obs-buildUpgrade kernel-default-extraUpgrade kernel-debug-develUpgrade dlm-kmp-defaultUpgrade kernel-rt_debug-develUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amlogic | May 15, 2024 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-image-generic-64kUpgrade linux-image-azureUpgrade linux-image-oem-24.04Upgrade linux-image-raspiUpgrade linux-image-generic-lpaeUpgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-genericUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-virtualUpgrade linux-image-azure-fdeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-ibm-classicUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-oem-24.04aUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-ibmUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-generic-64k-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-6.8.0-1008-azureUpgrade linux-image-awsUpgrade linux-image-6.8.0-1006-oemUpgrade linux-image-lowlatency | Jul 1, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Apr 28, 2024 |
Prioritize with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub