[PATCH] ALSA: usb-audio: fix stack info leak in RME Digiface status

[PATCH] ALSA: usb-audio: fix stack info leak in RME Digiface status

[Baul Lee]

snd_rme_digiface_read_status() reads a four-word status block from the
device into an uninitialised on-stack __le32 buf[4] and, whenever the
vendor control-IN transfer does not return a negative error, copies all
four words into the caller's status[].

snd_usb_ctl_msg() copies the full requested size back into the caller's
buffer regardless of how many bytes the data stage actually delivered:

	buf = kmemdup(data, size, GFP_KERNEL);
	err = usb_control_msg(dev, pipe, request, requesttype,
			      value, index, buf, size, timeout);
	memcpy(data, buf, size);

usb_control_msg() returns the transferred length on a short control-IN,
which is a non-negative value, and writes only that many bytes.  The
remainder of the copy back is the kmemdup()ed image of the caller's
buffer, so a device answering with a short data stage leaves the
trailing words of buf[] holding leftover kernel stack.  The only guard
in the caller is err < 0, so those words are stored into status[].

They then reach user space: snd_rme_digiface_get_status_val() selects a
16-bit halfword of status[] per the control's reg/mask, and the eight
Digiface status controls together expose the whole 16-byte frame to an
unprivileged reader of /dev/snd/controlC*.

Zero-initialise the buffer so a short read yields zeros instead of stack
residue.  This mirrors snd_rme_get_status1(), which already clears its
output word before the same kind of vendor read.

Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>

Fixes: 611a96f6acf2 ("ALSA: usb-audio: Add mixer quirk for RME Digiface USB")
Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
Reported-by: Baul Lee <baul.lee@xbow.com>
Cc: stable@vger.kernel.org
Signed-off-by: Baul Lee <baul.lee@xbow.com>
---
 sound/usb/mixer_quirks.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/sound/usb/mixer_quirks.c b/sound/usb/mixer_quirks.c
index fb3bd360e5a9..a1f5592cc5d5 100644
--- a/sound/usb/mixer_quirks.c
+++ b/sound/usb/mixer_quirks.c
@@ -3496,7 +3496,7 @@ static int snd_rme_digiface_read_status(struct snd_kcontrol *kcontrol, u32 statu
 	struct usb_mixer_elem_list *list = snd_kcontrol_chip(kcontrol);
 	struct snd_usb_audio *chip = list->mixer->chip;
 	struct usb_device *dev = chip->dev;
-	__le32 buf[4];
+	__le32 buf[4] = {};
 	int err;
 
 	err = snd_usb_ctl_msg(dev, usb_rcvctrlpipe(dev, 0),
-- 
2.50.1 (Apple Git-155)

Re: [PATCH] ALSA: usb-audio: fix stack info leak in RME Digiface status

[Takashi Iwai]

On Sun, 26 Jul 2026 08:50:20 +0200,
Baul Lee wrote:
> 
> snd_rme_digiface_read_status() reads a four-word status block from the
> device into an uninitialised on-stack __le32 buf[4] and, whenever the
> vendor control-IN transfer does not return a negative error, copies all
> four words into the caller's status[].
> 
> snd_usb_ctl_msg() copies the full requested size back into the caller's
> buffer regardless of how many bytes the data stage actually delivered:
> 
> 	buf = kmemdup(data, size, GFP_KERNEL);
> 	err = usb_control_msg(dev, pipe, request, requesttype,
> 			      value, index, buf, size, timeout);
> 	memcpy(data, buf, size);
> 
> usb_control_msg() returns the transferred length on a short control-IN,
> which is a non-negative value, and writes only that many bytes.  The
> remainder of the copy back is the kmemdup()ed image of the caller's
> buffer, so a device answering with a short data stage leaves the
> trailing words of buf[] holding leftover kernel stack.  The only guard
> in the caller is err < 0, so those words are stored into status[].
> 
> They then reach user space: snd_rme_digiface_get_status_val() selects a
> 16-bit halfword of status[] per the control's reg/mask, and the eight
> Digiface status controls together expose the whole 16-byte frame to an
> unprivileged reader of /dev/snd/controlC*.
> 
> Zero-initialise the buffer so a short read yields zeros instead of stack
> residue.  This mirrors snd_rme_get_status1(), which already clears its
> output word before the same kind of vendor read.
> 
> Discovered by XBOW, triaged by Baul Lee <baul.lee@xbow.com>
> 
> Fixes: 611a96f6acf2 ("ALSA: usb-audio: Add mixer quirk for RME Digiface USB")
> Reported-by: Federico Kirschbaum <federico.kirschbaum@xbow.com>
> Reported-by: Baul Lee <baul.lee@xbow.com>
> Cc: stable@vger.kernel.org
> Signed-off-by: Baul Lee <baul.lee@xbow.com>

Applied now.  Thanks.


Takashi