Executive Summary

This vulnerability exists in the Linux kernel's ALSA usb-audio driver related to the validation of USB Audio Class 3 (UAC3) header descriptors.

The validators table entry for the UAC3 Audio Control (AC) header descriptor incorrectly uses the protocol version UAC_VERSION_2 instead of UAC_VERSION_3.

As a result, the validator never matches actual UAC3 devices, causing their header descriptors to bypass validation entirely.

A malicious USB device presenting a truncated UAC3 header could exploit this flaw to cause out-of-bounds reads when the driver accesses unvalidated descriptor fields.

This bug was introduced due to a copy-paste error when the UAC3 section was created from the UAC2 section.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow a malicious USB device to cause out-of-bounds memory reads in the Linux kernel's usb-audio driver.

Such out-of-bounds reads can potentially lead to system instability, crashes, or information disclosure depending on how the kernel handles the invalid memory access.

If an attacker has physical access to connect a malicious USB device, they could exploit this vulnerability to affect the security and reliability of the affected system.

Useful 0 Not Useful 0