Buffer Overflow in Linux Kernel USB Audio MIDI Driver

Executive Summary

This vulnerability exists in the Linux kernel's ALSA usb-audio component, specifically in how it processes MIDI endpoint descriptors. The function snd_usbmidi_get_ms_info() attempts to validate the size of the internal MIDIStreaming endpoint descriptor before accessing certain data. However, the descriptor scanning process can still return a class-specific endpoint descriptor whose length (bLength) is larger than the remaining bytes available in the scan. This means that subsequent reads, which rely on bLength to determine how much data to read, might read beyond the valid boundary of the data buffer.

The fix involves stopping the scanning process when bLength is zero or when it extends beyond the remaining bytes in the scan, preventing out-of-bounds reads.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to out-of-bounds memory reads during the processing of USB MIDI audio device descriptors. Such out-of-bounds reads may cause system instability, crashes, or potentially expose sensitive memory contents to an attacker. This could be exploited by a malicious USB device to compromise the system's security or cause denial of service.

Useful 0 Not Useful 0