kernel: firmware: cs_dsp: Return error if block header overflows file

A denial of service vulnerability was found in the Linux kernel. No error was returned from the csdsppowerup function if a block header is longer than the amount of data left in the file...

kernel: firmware: cs_dsp: Validate payload length before processing block

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

kernel: firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

A vulnerability was found in the Linux kernel in the csdsp firmware involving the V2 algorithm headers and the wmfw V2 format, which introduced variable-length strings into the algorithm block header. This means the overall header length is variable and without proper checks can result in an...

CVE-2024-38402

creationtimestamp| type| source ---|---|--- 2024-09-02 15:33:28+00:00| seen| https://t.me/cvedetector/4639 2024-11-07 17:04:54+00:00| seen| https://vulnerability.circl.lu/bundle/aaa30339-107b-4cb3-8a1a-3e5d8398b429 2024-12-16 05:11:23+00:00| seen|...

CVE-2024-33060

creationtimestamp| type| source ---|---|--- 2024-09-02 15:33:12+00:00| seen| https://t.me/cvedetector/4628 2024-12-16 05:11:23+00:00| seen| https://googleprojectzero.blogspot.com/2024/12/qualcomm-dsp-driver-unexpectedly-excavating-exploit.html 2024-12-16 16:32:27+00:00| seen|...

CVE-2024-33038

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA...

CVE-2024-38402 Use After Free in DSP Services

Memory corruption while processing IOCTL call for getting group info...

CVE-2024-38402 Use After Free in DSP Services

Memory corruption while processing IOCTL call for getting group info...

CVE-2024-33060 Use After Free in DSP Service

Memory corruption when two threads try to map and unmap a single node simultaneously...

CVE-2024-33060 Use After Free in DSP Service

Memory corruption when two threads try to map and unmap a single node simultaneously...

CVE-2024-33038 Untrusted Pointer Dereference in Computer Vision

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA...

CVE-2024-33038 Untrusted Pointer Dereference in Computer Vision

Memory corruption while passing untrusted/corrupted pointers from DSP to EVA...

CVE-2024-33038

CVE-2024-33038 involves memory corruption when untrusted or corrupted pointers are passed from DSP to EVA in a Qualcomm/Camera-related Computer Vision path. The issue is characterized as local, with low attack complexity and high impact on confidentiality, integrity, and availability. Public refe...

firmware: cs_dsp: Prevent buffer overrun when processing V2 alg headers

...

firmware: cs_dsp: Return error if block header overflows file

...

SUSE CVE-2024-42238

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Return error if block header overflows file Return an error from csdsppowerup if a block header is longer than the amount of data left in the file. The previous code in csdspload and csdsploadcoeff would loop whi...

AZL-47595 CVE-2024-42237 affecting package kernel for versions less than 5.15.162.2-1

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

DEBIAN-CVE-2024-42237

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...

DEBIAN-CVE-2024-42238

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Return error if block header overflows file Return an error from csdsppowerup if a block header is longer than the amount of data left in the file. The previous code in csdspload and csdsploadcoeff would loop whi...

UBUNTU-CVE-2024-42237

In the Linux kernel, the following vulnerability has been resolved: firmware: csdsp: Validate payload length before processing block Move the payload length check in csdspload and csdspcoeffload to be done before the block is processed. The check that the length of a block payload does not exceed...