In the Linux kernel, the following vulnerability has been resolved:
ALSA: oss: Fix PCM OSS buffer allocation overflow
We've got syzbot reports hitting INTMAX overflow at vmalloc() allocation that is called from sndpcmplugalloc(). Although we apply the restrictions to input parameters, it's based only on the hwparams of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INTMAX, hence it hits WARN_ON().
This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated.
In addition, the driver uses arraysize() and array3size() for multiplications to catch overflows for the converted period size and buffer bytes.
[
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"signature_version": "v1",
"id": "CVE-2022-49292-0afa7494"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_period_size"
},
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"signature_version": "v1",
"id": "CVE-2022-49292-0ff1a581"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c",
"function": "snd_pcm_plugin_alloc"
},
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"signature_version": "v1",
"id": "CVE-2022-49292-1714223b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_change_params_locked"
},
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"signature_version": "v1",
"id": "CVE-2022-49292-1a9a220a"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_change_params_locked"
},
"digest": {
"length": 6271.0,
"function_hash": "149685443502811469772069543355244587583"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"signature_version": "v1",
"id": "CVE-2022-49292-1aadb0d4"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"signature_version": "v1",
"id": "CVE-2022-49292-1cacf862"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_period_size"
},
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"signature_version": "v1",
"id": "CVE-2022-49292-308d4984"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"signature_version": "v1",
"id": "CVE-2022-49292-32164561"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_period_size"
},
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"signature_version": "v1",
"id": "CVE-2022-49292-389241d4"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"signature_version": "v1",
"id": "CVE-2022-49292-401c6824"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_change_params_locked"
},
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"signature_version": "v1",
"id": "CVE-2022-49292-407243da"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c",
"function": "snd_pcm_plugin_alloc"
},
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"signature_version": "v1",
"id": "CVE-2022-49292-43a6f273"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"signature_version": "v1",
"id": "CVE-2022-49292-5345edea"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"signature_version": "v1",
"id": "CVE-2022-49292-53fa0aae"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_period_size"
},
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"signature_version": "v1",
"id": "CVE-2022-49292-574bfea7"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c",
"function": "snd_pcm_plugin_alloc"
},
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"signature_version": "v1",
"id": "CVE-2022-49292-6e6616aa"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"signature_version": "v1",
"id": "CVE-2022-49292-73725613"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"signature_version": "v1",
"id": "CVE-2022-49292-7993832b"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_change_params_locked"
},
"digest": {
"length": 6130.0,
"function_hash": "148095295293766673105207043526864278210"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"signature_version": "v1",
"id": "CVE-2022-49292-842ef8b3"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_period_size"
},
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"signature_version": "v1",
"id": "CVE-2022-49292-8a0ce5fd"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c",
"function": "snd_pcm_plugin_alloc"
},
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"signature_version": "v1",
"id": "CVE-2022-49292-aeebeade"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c",
"function": "snd_pcm_oss_change_params_locked"
},
"digest": {
"length": 6271.0,
"function_hash": "149685443502811469772069543355244587583"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"signature_version": "v1",
"id": "CVE-2022-49292-d8a109b1"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"signature_version": "v1",
"id": "CVE-2022-49292-de574041"
},
{
"signature_type": "Function",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_plugin.c",
"function": "snd_pcm_plugin_alloc"
},
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"signature_version": "v1",
"id": "CVE-2022-49292-e2929d22"
},
{
"signature_type": "Line",
"deprecated": false,
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"signature_version": "v1",
"id": "CVE-2022-49292-f4f8c512"
}
]