CVE-2024-42237
Medium
Description
In the Linux kernel, the following vulnerability has been resolved: firmware: cs_dsp: Validate payload length before processing block Move the payload length check in cs_dsp_load() and cs_dsp_coeff_load() to be done before the block is processed. The check that the length of a block payload does not exceed the number of remaining bytes in the firwmware file buffer was being done near the end of the loop iteration. However, some code before that check used the length field without validating it.
SeverityMedium
CVSS5.5
Exploit probability11. percentile0.2%
Product
Linux Kernel
PublishedAug 7, 2024
First seenAug 7, 2024
How to fix
Update
- linux linux_kernel5.16, 6.1.100, 6.6.41, 6.9.10 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linux linux_kernel | v < 5.16, 5.17 ≤ v < 6.1.100, 6.2 ≤ v < 6.6.41, 6.7 ≤ v < 6.9.10 | 5.16, 6.1.100, 6.6.41, 6.9.10 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.