CVE-2024-42238

MEDIUM

Linux Kernel < 6.1.100 - Buffer Overflow

Title source: rule
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Return error if block header overflows file Return an error from cs_dsp_power_up() if a block header is longer than the amount of data left in the file. The previous code in cs_dsp_load() and cs_dsp_load_coeff() would loop while there was enough data left in the file for a valid region. This protected against overrunning the end of the file data, but it didn't abort the file processing with an error.

Scores

CVSS v3 5.5
EPSS 0.0003
EPSS Percentile 9.6%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact partial

Details

CWE
CWE-120
Status published
Products (4)
linux/Kernel 5.16.0 - 6.1.100linux
linux/Kernel 6.2.0 - 6.6.41linux
linux/Kernel 6.7.0 - 6.9.10linux
linux/linux_kernel 5.16 - 6.1.100
Published Aug 07, 2024
Tracked Since Feb 18, 2026