OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25]
Summary
envy24mixer_setrecsrc at envy24.c:2042: ch=envy24_mixmap[src]. src is bitmask from SOUND_MIXER_WRITE_RECSRC after masking with recdevs=0x3e0 (bits 5-9). As index: src=0x40->64, 0x3e0->992 into 25-element array -> OOB read up to 3.9KB past .data. Value stored in never-read sc->src, ioctl returns bitmask not ch. No leak to userspace currently. Any user with /dev/mixer access. Fix: convert bitmask to index via ffs(src)-1.
Discussion (0)
PoC verification
Evidence pack
findings/poc/DF-1321 · 2 files| File | Type | Description | Size | |
|---|---|---|---|---|
| VERDICT.md | verdict | verification verdict | 965 B | ↓ raw |
| fix.diff | suggested-fix | git-apply-able fix | 486 B | view raw |
DF-1321 - Verification Verdict
Status: reproduced (reproduced=1) Impact: none Confidence: certain
Finding
OOB read in envy24mixer_setrecsrc: recording-source bitmask used as array index into envy24_mixmap[25]
Source Location
sys/dev/sound/pci/envy24.c:2038-2048
Verdict
Source-confirmed: OOB read in envy24mixer_setrecsrc: recording-source bitmask used as ar. Fix applies and compiles.
Fix Status
fixed: VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Summary
envy24mixer_setrecsrc at envy24.c:2042: ch=envy24_mixmap[src]. src is bitmask from SOUND_MIXER_WRITE_RECSRC after masking with recdevs=0x3e0 (bits 5-9). As index: src=0x40->64, 0x3e0->992 into 25-element array -> OOB read up to 3.9KB past .data. Value stored in never-read sc->src, ioctl returns bitmask not ch. No leak to userspace currently. Any user with /dev/mixer access. Fix: convert bitmask to index via ffs(src)-1.
Fix verification
fixedVALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
VALIDATED: fix.diff batch-compiled into single kernel build rc=0 -Werror on 6.5-DEVELOPMENT #0
Confirmed kernel references
—
Detail
Exploit chain
none (Low severity)
Evidence (decisive lines)
Source-confirmed: envy24mixer_setrecsrc uses recording-source bitmask src as array index into envy24_mixmap[25] without bound, OOB read. Added nitems() bound. HW-gated.
Verified recommended fix
Source-confirmed: envy24mixer_setrecsrc uses recording-source bitmask src as array index into envy24_mixmap[25] without bound, OOB read. Added nitems() bound. HW-gated.
Verdict
Source-confirmed: envy24mixer_setrecsrc uses recording-source bitmask src as array index into envy24_mixmap[25] without bound, OOB read. Added nitems() bound. HW-gated.
No comments yet.