In the Linux kernel, the following vulnerability has been resolved:
ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction
AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it:
kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type 'Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: showstack+0x52/0x58 kernel: dumpstacklvl+0x4a/0x5f kernel: dumpstack+0x10/0x12 kernel: ubsanepilogue+0x9/0x45 kernel: _ubsanhandleloadinvalidvalue.cold+0x44/0x49 kernel: fcpresponse.part.0.cold+0x1a/0x2b [sndfirewirelib] kernel: fcpresponse+0x28/0x30 [sndfirewirelib] kernel: fwcorehandlerequest+0x230/0x3d0 [firewirecore] kernel: handlearpacket+0x1d9/0x200 [firewireohci] kernel: ? handlearpacket+0x1d9/0x200 [firewireohci] kernel: ? transmitcompletecallback+0x9f/0x120 [firewirecore] kernel: arcontexttasklet+0xa8/0x2e0 [firewireohci] kernel: taskletactioncommon.constprop.0+0xea/0xf0 kernel: taskletaction+0x22/0x30 kernel: _dosoftirq+0xd9/0x2e3 kernel: ? irqfinalizeoneshot.part.0+0xf0/0xf0 kernel: dosoftirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: _localbhenableip+0x50/0x60 kernel: irqforcedthreadfn+0x7e/0x90 kernel: irqthread+0xba/0x190 kernel: ? irqthreadfn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irqthreadcheckaffinity+0xf0/0xf0 kernel: ? setkthreadstruct+0x50/0x50 kernel: retfromfork+0x22/0x30 kernel: </TASK> kernel: ================================================================================
This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification.
[
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d2c4a33dc1b4402cec68a3c8f82c6588b6edce",
"id": "CVE-2022-49248-220950fc",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eab74c41612083bd627b60da650e19234e4f1051",
"id": "CVE-2022-49248-3ee780d6",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@eab74c41612083bd627b60da650e19234e4f1051",
"id": "CVE-2022-49248-459ec026",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e",
"id": "CVE-2022-49248-46c42a18",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7025f40690a235a118c87674cfb93072694aa66d",
"id": "CVE-2022-49248-4f0de7b8",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60e5d391805d70458a01998de00d0c28cba40bf3",
"id": "CVE-2022-49248-54fd3a17",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99582e4b19f367fa95bdd150b3034d7ce8113342",
"id": "CVE-2022-49248-8b51090c",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7025f40690a235a118c87674cfb93072694aa66d",
"id": "CVE-2022-49248-8c9c179a",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e",
"id": "CVE-2022-49248-8ff6748a",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b65c9013dc28836d82e25d0f0c94d794a14aba",
"id": "CVE-2022-49248-94a16072",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e6f5786621df060f8296f074efd275eaf20361a",
"id": "CVE-2022-49248-a398246b",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@b2b65c9013dc28836d82e25d0f0c94d794a14aba",
"id": "CVE-2022-49248-ab75f196",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7e6f5786621df060f8296f074efd275eaf20361a",
"id": "CVE-2022-49248-adddf4b1",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@39d2c4a33dc1b4402cec68a3c8f82c6588b6edce",
"id": "CVE-2022-49248-caa87cd7",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@99582e4b19f367fa95bdd150b3034d7ce8113342",
"id": "CVE-2022-49248-d0a2303d",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@60e5d391805d70458a01998de00d0c28cba40bf3",
"id": "CVE-2022-49248-d226556e",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d",
"id": "CVE-2022-49248-f6b7623a",
"signature_version": "v1",
"target": {
"file": "sound/firewire/fcp.c"
},
"signature_type": "Line",
"digest": {
"threshold": 0.9,
"line_hashes": [
"157271646646235307937711600644148141984",
"7381093405246566966282202299411880555",
"101156285006889837471506621392552158180",
"317056673080778866155349769676688665656",
"14719146288259485800883621149282532835"
]
}
},
{
"deprecated": false,
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d",
"id": "CVE-2022-49248-f927d17d",
"signature_version": "v1",
"target": {
"function": "fcp_avc_transaction",
"file": "sound/firewire/fcp.c"
},
"signature_type": "Function",
"digest": {
"function_hash": "121805294275129119257918259069497288186",
"length": 1359.0
}
}
]