In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: Add some bounds checking to firmware data
Smatch complains about "head->full_size - head->header_size" can underflow. To some extent, we're always going to have to trust the firmware a bit. However, it's easy enough to add a check for negatives, and let's add a upper bounds check as well.
CVSS Details
- CVSS 3.1 Base Score: 8.4
- CVSS 3.1 Vector: (CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 28, 2024 |
| Redhat_linux | — | Upgrade kernel-rtUpgrade kernelNo solution exists | Dec 5, 2024 | Apr 28, 2024 |
| Suse | — | Upgrade cluster-md-kmp-defaultUpgrade kernel-rt_debug-develUpgrade dtb-amlogicUpgrade dlm-kmp-azureUpgrade dtb-lgUpgrade kernel-default-baseUpgrade kernel-rt-vdsoUpgrade kernel-syms-rtUpgrade dtb-sprdUpgrade dtb-freescaleUpgrade kernel-source-azureUpgrade kselftests-kmp-azureUpgrade kernel-kvmsmall-livepatch-develUpgrade reiserfs-kmp-64kbUpgrade kernel-docsUpgrade kernel-kvmsmallUpgrade kernel-azure-extraUpgrade cluster-md-kmp-64kbUpgrade kernel-macrosUpgrade kernel-azure-vdsoUpgrade kernel-devel-azureUpgrade gfs2-kmp-rtUpgrade kernel-rt-extraUpgrade kernel-default-develUpgrade dtb-appleUpgrade kernel-azure-livepatch-develUpgrade dtb-amdUpgrade kernel-azure-develUpgrade kernel-azure-optionalUpgrade dtb-socionextUpgrade kernel-default-extraUpgrade kselftests-kmp-rtUpgrade reiserfs-kmp-rtUpgrade cluster-md-kmp-azureUpgrade kernel-rt-livepatch-develUpgrade kernel-default-livepatchUpgrade kernel-source-rtUpgrade kernel-docs-htmlUpgrade kernel-rt_debug-vdsoUpgrade kernel-debug-vdsoUpgrade kernel-debug-livepatch-develUpgrade kernel-source-vanillaUpgrade kernel-rt_debugUpgrade dtb-marvellUpgrade dtb-broadcomUpgrade kernel-kvmsmall-vdsoUpgrade dtb-amazonUpgrade dlm-kmp-defaultUpgrade dlm-kmp-rtUpgrade kernel-debug-develUpgrade kernel-64kbUpgrade kernel-obs-buildUpgrade kernel-azureUpgrade ocfs2-kmp-64kbUpgrade kernel-rt-optionalUpgrade kselftests-kmp-defaultUpgrade kernel-default-vdsoUpgrade dtb-hisiliconUpgrade dtb-apmUpgrade dlm-kmp-64kbUpgrade cluster-md-kmp-rtUpgrade reiserfs-kmp-azureUpgrade kernel-kvmsmall-develUpgrade kernel-devel-rtUpgrade dtb-qcomUpgrade ocfs2-kmp-defaultUpgrade dtb-xilinxUpgrade kernel-default-base-rebuildUpgrade kernel-zfcpdumpUpgrade kernel-64kb-extraUpgrade kernel-obs-qaUpgrade kselftests-kmp-64kbUpgrade kernel-sourceUpgrade ocfs2-kmp-rtUpgrade gfs2-kmp-64kbUpgrade kernel-default-livepatch-develUpgrade kernel-64kb-develUpgrade dtb-nvidiaUpgrade kernel-rt-develUpgrade kernel-default-optionalUpgrade kernel-syms-azureUpgrade kernel-rt_debug-livepatch-develUpgrade kernel-64kb-optionalUpgrade kernel-64kb-livepatch-develUpgrade dtb-caviumUpgrade dtb-alteraUpgrade ocfs2-kmp-azureUpgrade kernel-rt-livepatchUpgrade gfs2-kmp-azureUpgrade dtb-exynosUpgrade dtb-armUpgrade reiserfs-kmp-defaultUpgrade kernel-symsUpgrade kernel-rtUpgrade kernel-develUpgrade kernel-defaultUpgrade kernel-debugUpgrade dtb-rockchipUpgrade dtb-renesasUpgrade dtb-mediatekUpgrade dtb-allwinnerUpgrade gfs2-kmp-default | May 15, 2024 | Apr 28, 2024 |
| Ubuntu | — | Upgrade linux-image-6.8.0-35-generic-64kUpgrade linux-image-raspiUpgrade linux-image-lowlatency-64kUpgrade linux-image-6.8.0-1006-ibmUpgrade linux-image-generic-lpaeUpgrade linux-image-genericUpgrade linux-image-6.8.0-1008-gcpUpgrade linux-image-generic-64kUpgrade linux-image-6.8.0-35-lowlatencyUpgrade linux-image-azureUpgrade linux-image-6.8.0-35-genericUpgrade linux-image-oem-24.04Upgrade linux-image-6.8.0-35-lowlatency-64kUpgrade linux-image-gkeUpgrade linux-image-6.8.0-1005-raspiUpgrade linux-image-azure-fdeUpgrade linux-image-gcpUpgrade linux-image-ibm-classicUpgrade linux-image-virtualUpgrade linux-image-virtual-hwe-24.04Upgrade linux-image-oracleUpgrade linux-image-kvmUpgrade linux-image-6.8.0-1004-gkeUpgrade linux-image-6.8.0-1009-awsUpgrade linux-image-awsUpgrade linux-image-generic-hwe-24.04Upgrade linux-image-6.8.0-1008-azureUpgrade linux-image-6.8.0-1006-oracle-64kUpgrade linux-image-ibmUpgrade linux-image-ibm-lts-24.04Upgrade linux-image-6.8.0-1006-oemUpgrade linux-image-6.8.0-1006-oracleUpgrade linux-image-lowlatencyUpgrade linux-image-oracle-64kUpgrade linux-image-6.8.0-1008-azure-fdeUpgrade linux-image-oem-24.04aUpgrade linux-image-generic-64k-hwe-24.04 | Jul 1, 2024 | Apr 28, 2024 |
| Vmware Photon_os | — | Use 'tdnf update' to upgrade all packages to the latest version. | Oct 14, 2025 | Apr 28, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub