CyberRota Analysis
AI-GeneratedThe vulnerability in the Linux kernel affects the handling of PCM and DAI name strings within topology objects, where insufficient validation allows for the potential reading of memory beyond allocated buffers. This could lead to information disclosure or undefined behavior when processing malformed topology blobs. Linux system administrators and developers working with audio subsystem configurations should prioritize addressing this issue to mitigate potential security risks.
Original NVD Description
In the Linux kernel, the following vulnerability has been resolved: ASoC: topology: Check PCM and DAI name strings before use Topology objects store several PCM and DAI names in fixed-size UAPI arrays. Other topology parser paths validate these fields with bounded strnlen() checks before using them as C strings, but the PCM and DAI paths still pass some fixed-size arrays directly to strlen(), devm_kstrdup(), DAI lookup, and diagnostic prints. A malformed topology blob with a non-NUL-terminated PCM, DAI, or stream capability name can therefore make the parser read past the end of the fixed-size field. Reject unterminated PCM and DAI name fields before consuming them as C strings.