CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HIn the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: fix OOB write in snd_usbmidi_akai_output() snd_usbmidi_akai_output() computes its fill-loop bound buf_end = ep->max_transfer - MAX_AKAI_SYSEX_LEN - 1; as a signed int, so a small device-advertised bulk-OUT max_transfer makes buf_end negative. The loop guard then compares the u32 urb->transfer_buffer_length against that negative int: the usual arithmetic conversion turns buf_end into a large unsigned value, so the guard stays true and each iteration keeps appending SysEx framing and payload bytes past the end of the URB transfer buffer, which is only max_transfer bytes long. A USB device that advertises a tiny bulk-OUT endpoint can therefore trigger an attacker-length- and content-controlled heap out-of-bounds write when a process writes to the created /dev/snd/midiC*D* node. Return early when there is no room for even one SysEx, so the loop is never entered with a bound that would wrap. The loop is the last statement of the function, so bailing out is equivalent to it not running. Discovered by XBOW, triaged by Baul Lee <[email protected]> A flaw was found in the kernel's Advanced Linux Sound Architecture (ALSA) USB audio driver. An integer overflow vulnerability in the `snd_usbmidi_akai_output()` function, when processing data from a USB device with a small bulk-OUT endpoint, can lead to an out-of-bounds write in the kernel heap. A local attacker, by writing to a MIDI device node with a specially crafted USB device, could exploit this to achieve arbitrary code execution or cause a denial of service.
Multiple vulnerabilities have been discovered in the Linux kernel of Debian. These vulnerabilities allow for privilege escalation, data compromise, and denial of service. The affected Debian versions are prior to 6.12.10…