Linux Kernel Out-of-Bounds Access Vulnerability in ASoC rsnd Component

A potential out-of-bounds access vulnerability has been identified in the Linux kernel's ASoC (ALSA System on Chip) rsnd component, specifically within the Renesas R-Car audio driver. This issue arises because the 'component_dais' array, which is used to manage audio data interfaces, is initially zero-initialized and later populated by the 'rsnd_dai_of_node()' function. The existing boundary check fails to ensure that the last valid element of the array remains zero, allowing the possibility for the loop to incorrectly assume that 'component_dais[RSND_MAX_COMPONENT]' is zero. This flaw can lead to out-of-bounds access, potentially causing memory corruption or other unintended behavior.

Impact

Exploitation of this vulnerability could result in out-of-bounds memory access, leading to potential memory corruption or other undefined behavior in the kernel.

Reproduction

The vulnerability can be reproduced by loading a Renesas R-Car audio graph card with the ASoC rsnd component. The 'component_dais' array will be populated with values greater than zero, except for the last element, which may not be correctly validated. When the audio component is registered, the loop that processes the 'component_dais' array can access memory out of bounds, specifically at 'component_dais[RSND_MAX_COMPONENT]'.

Remediation

Users can upgrade to the latest version of the Linux kernel where this vulnerability has been fixed. The commit that addresses this issue is available in the Linux kernel stable tree.