CVSS: 5.2EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41039 – firmware: cs_dsp: Fix overflow checking of wmfw header
https://notcve.org/view.php?id=CVE-2024-41039
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Fix overflow checking of wmfw header Fix the checking that firmware file buffer is large enough for the wmfw header, to prevent overrunning the buffer. The original code tested that the firmware data buffer contained enough bytes for the sums of the size of the structs wmfw_header + wmfw_adsp1_sizes + wmfw_footer But wmfw_adsp1_sizes is only used on ADSP1 firmware. ... A vulnerability was found in the Linux kernel's firmware driver cs_dsp.c, where a buffer overflow is possible in the wmfw header due to insufficient buffer size checks. • https://git.kernel.org/stable/c/f6bc909e7673c30abcbdb329e7d0aa2e83c103d7 https://git.kernel.org/stable/c/fd035f0810b33c2a8792effdb82bf35920221565 https://git.kernel.org/stable/c/9c9877a96e033bf6c6470b3b4f06106d91ace11e https://git.kernel.org/stable/c/49a79f344d0a17c6a5eef53716cc76fcdbfca9ba https://git.kernel.org/stable/c/3019b86bce16fbb5bc1964f3544d0ce7d0137278 https://access.redhat.com/security/cve/CVE-2024-41039 https://bugzilla.redhat.com/show_bug.cgi?id=2300408 • CWE-122: Heap-based Buffer Overflow •
CVSS: 5.5EPSS: 0%CPEs: 4EXPL: 0CVE-2024-41038 – firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers
https://notcve.org/view.php?id=CVE-2024-41038
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers Check that all fields of a V2 algorithm header fit into the available firmware data buffer. The wmfw V2 format introduced variable-length strings in the algorithm block header. • https://git.kernel.org/stable/c/f6bc909e7673c30abcbdb329e7d0aa2e83c103d7 https://git.kernel.org/stable/c/6619aa48a011364e9f29083cc76368e6acfe5b11 https://git.kernel.org/stable/c/76ea8e13aaefdfda6e5601323d6ea5340359dcfa https://git.kernel.org/stable/c/014239b9971d79421a0ba652579e1ca1b7b57b6d https://git.kernel.org/stable/c/2163aff6bebbb752edf73f79700f5e2095f3559e https://access.redhat.com/security/cve/CVE-2024-41038 https://bugzilla.redhat.com/show_bug.cgi?id=2300407 • CWE-122: Heap-based Buffer Overflow •
CVSS: -EPSS: 0%CPEs: 3EXPL: 0CVE-2024-41037 – ASoC: SOF: Intel: hda: fix null deref on system suspend entry
https://notcve.org/view.php?id=CVE-2024-41037
In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: Intel: hda: fix null deref on system suspend entry When system enters suspend with an active stream, SOF core calls hw_params_upon_resume(). • https://git.kernel.org/stable/c/2b009fa0823c1510700fd17a0780ddd06a460fb4 https://git.kernel.org/stable/c/8246bbf818ed7b8d5afc92b951e6d562b45c2450 https://git.kernel.org/stable/c/993af0f2d9f24e3c18a445ae22b34190d1fcad61 https://git.kernel.org/stable/c/9065693dcc13f287b9e4991f43aee70cf5538fdd •
CVSS: -EPSS: 0%CPEs: 6EXPL: 0CVE-2024-41036 – net: ks8851: Fix deadlock with the SPI chip variant
https://notcve.org/view.php?id=CVE-2024-41036
In the Linux kernel, the following vulnerability has been resolved: net: ks8851: Fix deadlock with the SPI chip variant When SMP is enabled and spinlocks are actually functional then there is a deadlock with the 'statelock' spinlock between ks8851_start_xmit_spi and ks8851_irq: watchdog: BUG: soft lockup - CPU#0 stuck for 27s! • https://git.kernel.org/stable/c/1092525155eaad5c69ca9f3b6f3e7895a9424d66 https://git.kernel.org/stable/c/30302b41ffdcd194bef27fb3b1a9f2ca53dedb27 https://git.kernel.org/stable/c/3dc5d44545453de1de9c53cc529cc960a85933da https://git.kernel.org/stable/c/786788bb1396ed5ea27e39c4933f59f4e52004e4 https://git.kernel.org/stable/c/7c25c5d7274631b655f0f9098a16241fcd5db57b https://git.kernel.org/stable/c/a0c69c492f4a8fad52f0a97565241c926160c9a4 https://git.kernel.org/stable/c/80ece00137300d74642f2038c8fe5440deaf9f05 https://git.kernel.org/stable/c/10fec0cd0e8f56ff06c46bb24254c7d8f •
CVSS: 5.5EPSS: 0%CPEs: 15EXPL: 0CVE-2024-41035 – USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor
https://notcve.org/view.php?id=CVE-2024-41035
In the Linux kernel, the following vulnerability has been resolved: USB: core: Fix duplicate endpoint bug by clearing reserved bits in the descriptor Syzbot has identified a bug in usbcore (see the Closes: tag below) caused by our assumption that the reserved bits in an endpoint descriptor's bEndpointAddress field will always be 0. ... A vulnerability was found in the usb_parse_endpoint() function in the Linux kernel's usb drivers, where improper handling of the reserved bits in an endpoint descriptor's bEndpointAddress field can lead to confusion in the endpoint_is_duplicate() routine in config.c. • https://git.kernel.org/stable/c/0a8fd1346254974c3a852338508e4a4cddbb35f1 https://git.kernel.org/stable/c/c3726b442527ab31c7110d0445411f5b5343db01 https://git.kernel.org/stable/c/15668b4354b38b41b316571deed2763d631b2977 https://git.kernel.org/stable/c/8597a9245181656ae2ef341906e5f40af323fbca https://git.kernel.org/stable/c/264024a2676ba7d91fe7b1713b2c32d1b0b508cb https://git.kernel.org/stable/c/b0de742a1be16b76b534d088682f18cf57f012d2 https://git.kernel.org/stable/c/7cc00abef071a8a7d0f4457b7afa2f57f683d83f https://git.kernel.org/stable/c/05b0f2fc3c2f9efda47439557e0d51fac • CWE-99: Improper Control of Resource Identifiers ('Resource Injection') •