CVE-2024-42088

In the Linux kernel, the following vulnerability has been resolved:

ASoC: mediatek: mt8195: Add platform entry for ETDM1_OUT_BE dai link

Commit e70b8dd26711 ("ASoC: mediatek: mt8195: Remove afe-dai component and rework codec link") removed the codec entry for the ETDM1_OUT_BE dai link entirely instead of replacing it with COMP_EMPTY(). This worked by accident as the remaining COMP_EMPTY() platform entry became the codec entry, and the platform entry became completely empty, effectively the same as COMP_DUMMY() since snd_soc_fill_dummy_dai() doesn't do anything for platform entries.

This causes a KASAN out-of-bounds warning in mtk_soundcard_common_probe() in sound/soc/mediatek/common/mtk-soundcard-driver.c:

for_each_card_prelinks(card, i, dai_link) {
	if (adsp_node && !strncmp(dai_link->name, "AFE_SOF", strlen("AFE_SOF")))
		dai_link->platforms->of_node = adsp_node;
	else if (!dai_link->platforms->name && !dai_link->platforms->of_node)
		dai_link->platforms->of_node = platform_node;
}

where the code expects the platforms array to have space for at least one entry.

Add an COMP_EMPTY() entry so that dai_link->platforms has space.

A flaw was found in the Linux kernel's MediaTek MT8195 ASoC soundcard support. Because the ETDM1_OUT_BE DAI link was left without a platform entry, the dai_link->platforms array can be empty, and mtk_soundcard_common_probe() in sound/soc/mediatek/common/mtk-soundcard-driver.c then writes dai_link->platforms->of_node out of bounds when it expects space for at least one entry. A local user on a system using the affected MediaTek MT8195 soundcard driver could exploit this flaw to trigger an out-of-bounds kernel memory access and impact system availability. Red Hat assesses the impact of this flaw as Low: exploitation requires local access to hardware using the MT8195 soundcard driver, and the Red Hat CVSSv3 score (4.1, availability-only impact with high privileges and high attack complexity required) is materially lower than the NIST score of 7.8. This flaw does not affect Red Hat Enterprise Linux: all shipped RHEL kernel and kernel-rt streams are recorded as not affected because the defect was introduced in upstream Linux kernel 6.8 and is not present in the kernel versions shipped in those streams. Fedora kernels are affected, and a fix is being pursued through the Fedora kernel updates.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.