Affected: Linux

In the Linux kernel, the following vulnerability has been resolved:

ALSA: FCP: fix OOB write in fcp_meter_ctl_get()

fcp_ioctl_set_meter_map() bounds the user-supplied Level Meter map size by the driver's own limit of 255

if (map.map_size < 1 || map.map_size > 255 || map.meter_slots < 1 || map.meter_slots > 255) return -EINVAL;

and passes it to fcp_add_new_ctl() as the control's channel count, where it is stored as elem->channels.

Every control read writes into struct snd_ctl_elem_value, whose integer array is declared long value[128], so the limit is 128, not 255. fcp_meter_ctl_get() stores one 64-bit word per channel into that array with no bound of its own:

for (i = 0; i < elem->channels; i++) { int idx = private->meter_level_map[i]; int value = idx < 0 ? 0 : le32_to_cpu(resp[idx]);

ucontrol->value.integer.value[i] = value; }

snd_ctl_elem_read_user() serves that object from memdup_user(_control, sizeof(*control)), 1224 bytes on LP64 out of kmalloc-2048. offsetof(struct snd_ctl_elem_value, value) is 72, so element i is written at byte 72 + 8 * i and element 144 already lands past the allocation. At map_size 255 the last store ends at byte 2112, 888 bytes past the object and 64 bytes into the adjacent slab object. The stored words come from the device and meter_level_map[] selects which word lands in which slot, so extent and contents are both controlled.

The core does not catch this. snd_ctl_check_elem_info() is reached only from __snd_ctl_elem_i…