In the Linux kernel, the following vulnerability has been resolved:
ALSA: oss: Fix PCM OSS buffer allocation overflow
We've got syzbot reports hitting INTMAX overflow at vmalloc() allocation that is called from sndpcmplugalloc(). Although we apply the restrictions to input parameters, it's based only on the hwparams of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INTMAX, hence it hits WARN_ON().
This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated.
In addition, the driver uses arraysize() and array3size() for multiplications to catch overflows for the converted period size and buffer bytes.
[
{
"id": "CVE-2022-49292-072bff39",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb08bf99195a87c798bc8ae1357337a981faeade",
"deprecated": false
},
{
"id": "CVE-2022-49292-0afa7494",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"deprecated": false
},
{
"id": "CVE-2022-49292-0ff1a581",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"deprecated": false
},
{
"id": "CVE-2022-49292-1714223b",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"deprecated": false
},
{
"id": "CVE-2022-49292-1a9a220a",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"deprecated": false
},
{
"id": "CVE-2022-49292-1aadb0d4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6271.0,
"function_hash": "149685443502811469772069543355244587583"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"deprecated": false
},
{
"id": "CVE-2022-49292-1cacf862",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"deprecated": false
},
{
"id": "CVE-2022-49292-1ef4e2c3",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb08bf99195a87c798bc8ae1357337a981faeade",
"deprecated": false
},
{
"id": "CVE-2022-49292-308d4984",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"deprecated": false
},
{
"id": "CVE-2022-49292-32164561",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"deprecated": false
},
{
"id": "CVE-2022-49292-389241d4",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"deprecated": false
},
{
"id": "CVE-2022-49292-401c6824",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"deprecated": false
},
{
"id": "CVE-2022-49292-407243da",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"deprecated": false
},
{
"id": "CVE-2022-49292-43a6f273",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@efb6402c3c4a7c26d97c92d70186424097b6e366",
"deprecated": false
},
{
"id": "CVE-2022-49292-49eb04ec",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb08bf99195a87c798bc8ae1357337a981faeade",
"deprecated": false
},
{
"id": "CVE-2022-49292-4d5a2506",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a40cbf3579a8e14849ba7ce46309c1992658d2b",
"deprecated": false
},
{
"id": "CVE-2022-49292-5345edea",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"deprecated": false
},
{
"id": "CVE-2022-49292-53fa0aae",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"deprecated": false
},
{
"id": "CVE-2022-49292-574bfea7",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"deprecated": false
},
{
"id": "CVE-2022-49292-6e6616aa",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"deprecated": false
},
{
"id": "CVE-2022-49292-6ea4a256",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6136.0,
"function_hash": "48584698655915352710286180264235998510"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a40cbf3579a8e14849ba7ce46309c1992658d2b",
"deprecated": false
},
{
"id": "CVE-2022-49292-701cf374",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb08bf99195a87c798bc8ae1357337a981faeade",
"deprecated": false
},
{
"id": "CVE-2022-49292-73725613",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"129280151612539939757884858003090174823",
"136558385342325124738970335705957372422",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"deprecated": false
},
{
"id": "CVE-2022-49292-7993832b",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"deprecated": false
},
{
"id": "CVE-2022-49292-842ef8b3",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6130.0,
"function_hash": "148095295293766673105207043526864278210"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"deprecated": false
},
{
"id": "CVE-2022-49292-8a0ce5fd",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"deprecated": false
},
{
"id": "CVE-2022-49292-a6bc8810",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a40cbf3579a8e14849ba7ce46309c1992658d2b",
"deprecated": false
},
{
"id": "CVE-2022-49292-aeebeade",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1376.0,
"function_hash": "252900107326378592140364477399950742525"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@e74a069c6a7bb505f3ade141dddf85f4b0b5145a",
"deprecated": false
},
{
"id": "CVE-2022-49292-d64b33e7",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 2055.0,
"function_hash": "200363386677188138246086907185320579353"
},
"target": {
"function": "snd_pcm_oss_period_size",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fb08bf99195a87c798bc8ae1357337a981faeade",
"deprecated": false
},
{
"id": "CVE-2022-49292-d8a109b1",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 6271.0,
"function_hash": "149685443502811469772069543355244587583"
},
"target": {
"function": "snd_pcm_oss_change_params_locked",
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@0c4190b41a69990666b4000999e27f8f1b2a426b",
"deprecated": false
},
{
"id": "CVE-2022-49292-de574041",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@5ce74ff7059341d8b2f4d01c3383491df63d1898",
"deprecated": false
},
{
"id": "CVE-2022-49292-e0ce9168",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a40cbf3579a8e14849ba7ce46309c1992658d2b",
"deprecated": false
},
{
"id": "CVE-2022-49292-e2929d22",
"signature_type": "Function",
"signature_version": "v1",
"digest": {
"length": 1374.0,
"function_hash": "196345267802741713263646812963946191695"
},
"target": {
"function": "snd_pcm_plugin_alloc",
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"deprecated": false
},
{
"id": "CVE-2022-49292-ec32400c",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"65062016781534746880757153304117807128",
"310207096378434380827930349681887144019",
"119572531936758955154953439847311814661",
"314102854121074578847340685419455759886"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_plugin.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@7a40cbf3579a8e14849ba7ce46309c1992658d2b",
"deprecated": false
},
{
"id": "CVE-2022-49292-f4f8c512",
"signature_type": "Line",
"signature_version": "v1",
"digest": {
"line_hashes": [
"162127336303590823498748205468819713184",
"58012890399180359015590006615043255457",
"26263203497498592167505944897906349267",
"288590288586378179159953555195171962171",
"176455461450477794073540994866393976373",
"134504832690893235264709870604622166807",
"20425348385352703918565834410588288676",
"261476185647118829169525526132294982295",
"140592350808228247965284780938995732903",
"21836329476639679348608863044026044441"
],
"threshold": 0.9
},
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@a63af1baf0a5e11827db60e3127f87e437cab6e5",
"deprecated": false
}
]