CVE-2024-42097

ALSA: emux: improve patch ioctl data validation

State: Published
Severity: 7.8 High
Published: Jul 29, 2024
Updated: Oct 15, 2026
Reserved: Jul 29, 2024

Description

In the Linux kernel, the following vulnerability has been resolved:

ALSA: emux: improve patch ioctl data validation

In load_data(), make the validation of and skipping over the main info block match that in load_guspatch().

In load_guspatch(), add checking that the specified patch length matches the actually supplied data, like load_data() already did.

Scores

CVSS	Score	Vector	Source
3.1	7.8 High	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	Linux

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
LinuxLinux	1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 40d7def67841343c10f8642a41031fecbb248babAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 79d9a000f0220cdaba1682d2a23c0d0c61d620a3Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d23982ea9aa438f35a8c8a6305943e98a8db90f6Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7a18293fd8d8519c2f7a03753bc1583b18e3db69Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d0ff2443fcbb472206d45a5d2a90cc694065804eAffected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d8f5ce3cb9adf0c72e2ad6089aba02d7a32469c2Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87039b83fb7bfd7d0e0499aaa8e6c049906b4d14Affected 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89b32ccb12ae67e630c6453d778ec30a592a212fAffected
LinuxLinux	2.6.12Affected before 2.6.12Not affected 4.19.317 through 4.19.Not affected 5.4.279 through 5.4.Not affected 5.10.221 through 5.10.Not affected 5.15.162 through 5.15.Not affected 6.1.97 through 6.1.Not affected 6.6.37 through 6.6.Not affected 6.9.8 through 6.9.*Not affected 6.10 and laterNot affected

Product

Versions

LinuxLinux

1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 40d7def67841343c10f8642a41031fecbb248babAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 79d9a000f0220cdaba1682d2a23c0d0c61d620a3Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d23982ea9aa438f35a8c8a6305943e98a8db90f6Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 7a18293fd8d8519c2f7a03753bc1583b18e3db69Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d0ff2443fcbb472206d45a5d2a90cc694065804eAffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before d8f5ce3cb9adf0c72e2ad6089aba02d7a32469c2Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 87039b83fb7bfd7d0e0499aaa8e6c049906b4d14Affected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to before 89b32ccb12ae67e630c6453d778ec30a592a212fAffected

LinuxLinux

2.6.12Affected
before 2.6.12Not affected
4.19.317 through 4.19.*Not affected
5.4.279 through 5.4.*Not affected
5.10.221 through 5.10.*Not affected
5.15.162 through 5.15.*Not affected
6.1.97 through 6.1.*Not affected
6.6.37 through 6.6.*Not affected
6.9.8 through 6.9.*Not affected
6.10 and laterNot affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.