Buffer Overflow Vulnerability in Intel's Linux Kernel Audio Subsystem

CVE-2022-50325

What is CVE-2022-50325?

A buffer overflow vulnerability was identified in the Audio Stream Control (ASoC) module of Intel's Linux kernel. When processing audio configuration requests, specifically for the LARGE_CONFIG_GET event, the code could incorrectly handle a scenario where the firmware returns an invalid size. As a result, the function memcpy_fromio() could attempt to copy more data than the allocated buffer can hold, leading to potential memory corruption. This issue has been mitigated by implementing safeguards that ensure only the minimum required number of bytes is copied, thus preventing the overflow.

References