CVE-2024-46862

In the Linux kernel, the following vulnerability has been resolved:

ASoC: Intel: soc-acpi-intel-mtl-match: add missing empty item

There is no links_num in struct snd_soc_acpi_mach {}, and we test !link->num_adr as a condition to end the loop in hda_sdw_machine_select(). So an empty item in struct snd_soc_acpi_link_adr array is required.

A low severity out-of-bounds read was found in the Linux kernel's ASoC Intel Meteor Lake (MTL) SoundWire machine selection code, affecting the kernel and kernel-rt packages in specific Red Hat Enterprise Linux 9 update streams and the community Fedora kernel. The MTL ACPI match table (sound/soc/intel/common/soc-acpi-intel-mtl-match.c) was missing a terminating empty entry in its array of struct snd_soc_acpi_link_adr links. Because hda_sdw_machine_select() ends its loop over this array only when it encounters an entry with a zero num_adr value, the loop can read past the end of the array during SoundWire machine selection at audio driver initialization on Intel Meteor Lake systems with the affected hardware, which can cause out-of-bounds memory reads and potential system instability; the impact is limited to availability. Red Hat rated this flaw Low severity (CVSS 3.1: 2.3, AV:L/AC:L/PR:H/UI:N/S:U/C:N/I:N/A:L), reflecting the local attack vector, high privileges required, and low availability-only impact; this differs from external ratings, which scored the flaw 5.5 (Moderate, NIST) and 8.0 (Important, CVE.org). The vulnerable code was introduced in upstream kernel 6.10, so Red Hat Enterprise Linux 6, 7, and 8, the RHEL 9.4 z-stream, and the hosted OpenShift (ARO and OSD) environments do not contain the flaw and are not affected. For Red Hat Enterprise Linux 9.5, the fix is deferred because of the low severity and the narrow hardware scope of the issue; the residual risk is an out-of-bounds read during audio subsystem initialization on Intel Meteor Lake SoundWire systems. For Red Hat Enterprise Linux 9.6, a fix is being pursued through the RHEL 9 kernel. The Fedora community kernel was also affected and remediation is handled by the Fedora community.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.