CVE-2024-41039

A vulnerability was found in the Linux kernel's firmware driver cs_dsp.c, where a buffer overflow is possible in the wmfw header due to insufficient buffer size checks. The issue stems from the size of one of the structs that the code checks, the wmfw_adsp?_sizes struct, which can vary depending on whether the firmware used is ADSP1 or ADSP2 and Halo Core. In the second case, the wmfw_adsp2_sizes struct is 4 bytes longer, which can cause a buffer overflow, potentially leading to undefined behavior in the system.

Red Hat believes this flaw to be of moderate severity because successful exploitation of this vulnerability would require elevated privileges to be able to access/modify the firmware loading mechanism. It also presents an elevated attack complexity given that the attacker requires knowledge of the Cirrus Logic DSP firmware to be able to craft special firmware to exploit the buffer overflow. Finally, depending on when the vulnerability is executed (ex. at boot time or during runtime) the impact on the system might change drastically; in one scenario it might cause a kernel crash in another just the audio driver might stop working.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.