linux-kernel - Re: [PATCH] ALSA: usb-mixer: us16x08: validate meter packet indices

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <87tsxu918p.wl-tiwai@suse.de>
Date: Sat, 13 Dec 2025 10:31:34 +0100
From: Takashi Iwai <tiwai@...e.de>
To: "Vulnerability Report" <vr@...knavy.com>
Cc: "Jaroslav Kysela" <perex@...ex.cz>,
	"Takashi Iwai" <tiwai@...e.com>,
	"alsa-devel" <alsa-devel@...a-project.org>,
	"linux-kernel" <linux-kernel@...r.kernel.org>
Subject: Re: [PATCH] ALSA: usb-mixer: us16x08: validate meter packet indices

On Fri, 12 Dec 2025 07:54:37 +0100,
Vulnerability Report wrote:
> 
> Hi,
> 
> while fuzzing a USB gadget that emulates a Tascam US-16x08 we found that
> get_meter_levels_from_urb() in mixer_us16x08.c uses a channel index
> taken directly from the 64-byte meter packet to index meter_level[],
> comp_level[] and master_level[] without any bounds checking. A malformed
> packet can therefore cause out-of-bounds writes in the
> snd_us16x08_meter_store.
> 
> 
> A malicious USB audio device (or USB gadget implementation) that
> pretends to be a US-16x08-compatible interface can trigger this by
> sending crafted meter packets. We have a small USB gadget-based PoC for
> this behaviour and can share it if that would be helpful.
> 
> 
> This driver is used by common distributions (e.g. Ubuntu) when a
> US-16x08 or compatible USB audio device is present. The same pattern is
> present in current mainline kernels.
> 
> 
> This issue was first reported via security@...nel.org. The kernel
> security team explained that, in the upstream threat model, USB
> endpoints are expected to be trusted (i.e. only trusted devices should
> be bound to drivers), so they consider this a normal bug rather than a
> security vulnerability, and asked us to send a fix to the development
> lists. The patch below adds simple range checks before updating these
> arrays.
> 
> 
> Suggested patch:
> 
> 
> ---
> &nbsp;sound/usb/mixer_us16x08.c | 15 +++++++++++++--
> &nbsp;1 file changed, 13 insertions(+), 2 deletions(-)
> 
> 
> diff --git a/sound/usb/mixer_us16x08.c b/sound/usb/mixer_us16x08.c
> index XXXXXXXX..YYYYYYYY 100644
> --- a/sound/usb/mixer_us16x08.c
> +++ b/sound/usb/mixer_us16x08.c
> @@ -647,15 +647,26 @@ static int snd_get_meter_comp_index(struct snd_us16x08_meter_store *store)
> &nbsp;/* retrieve the meter level values from URB message */
> &nbsp;static void get_meter_levels_from_urb(int s,
> &nbsp;     struct snd_us16x08_meter_store *store,
> &nbsp;     u8 *meter_urb)
> &nbsp;{
> &nbsp;     int val = MUC2(meter_urb, s) + (MUC3(meter_urb, s) << 8);
> +     int ch = MUB2(meter_urb, s) - 1;
> +
> +     if (ch < 0)
> +           return;
> &nbsp;
> &nbsp;     if (MUA0(meter_urb, s) == 0x61 &amp;&amp; MUA1(meter_urb, s) == 0x02 &amp;&amp;
> -           MUA2(meter_urb, s) == 0x04 &amp;&amp; MUB0(meter_urb, s) == 0x62) {
> -           if (MUC0(meter_urb, s) == 0x72)
> -                 store-&gt;meter_level[MUB2(meter_urb, s) - 1] = val;
> -           if (MUC0(meter_urb, s) == 0xb2)
> -                 store-&gt;comp_level[MUB2(meter_urb, s) - 1] = val;
> -     }
> +           MUA2(meter_urb, s) == 0x04 &amp;&amp; MUB0(meter_urb, s) == 0x62) {
> +           if (ch < SND_US16X08_MAX_CHANNELS) {
> +                 if (MUC0(meter_urb, s) == 0x72)
> +                       store-&gt;meter_level[ch] = val;
> +                 if (MUC0(meter_urb, s) == 0xb2)
> +                       store-&gt;comp_level[ch] = val;
> +           }
> +     }
> &nbsp;     if (MUA0(meter_urb, s) == 0x61 &amp;&amp; MUA1(meter_urb, s) == 0x02 &amp;&amp;
> -           MUA2(meter_urb, s) == 0x02 &amp;&amp; MUB0(meter_urb, s) == 0x62)
> -           store-&gt;master_level[MUB2(meter_urb, s) - 1] = val;
> +           MUA2(meter_urb, s) == 0x02 &amp;&amp; MUB0(meter_urb, s) == 0x62) {
> +           if (ch < ARRAY_SIZE(store-&gt;master_level))
> +                 store-&gt;master_level[ch] = val;
> +     }
> &nbsp;}
> 
> 
> Reported-by: DARKNAVY (@DarkNavyOrg) <vr@...knavy.com&gt;
> Signed-off-by: DARKNAVY (@DarkNavyOrg) <vr@...knavy.com&gt;

The while mail and the patch are malformed due to your mailer and
can't be applied.  Could you try to resubmit with a proper patch
description?  Also, Signed-off-by must be with a real name or a known
identity, no anonymous name, due to a legal requirement.


thanks,

Takashi