mirror of https://lore.kernel.org/lkml/
 help / color / mirror / Atom feed
From: Siddh Raman Pant <siddh.raman.pant@oracle.com>
To: "gregkh@linuxfoundation.org" <gregkh@linuxfoundation.org>
Cc: "cve@kernel.org" <cve@kernel.org>,
	"linux-kernel@vger.kernel.org" <linux-kernel@vger.kernel.org>,
	"gregkh@kernel.org" <gregkh@kernel.org>
Subject: Re: CVE-2025-39751: ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
Date: Mon, 6 Oct 2025 07:07:00 +0000	[thread overview]
Message-ID: <f24f4524894417954b9de4ccec69c2e17aae3d5f.camel@oracle.com> (raw)
In-Reply-To: <2025091142-CVE-2025-39751-c340@gregkh>

[-- Attachment #1: Type: text/plain, Size: 673 bytes --]

On Thu, 11 Sep 2025 18:52:52 +0200, Greg Kroah-Hartman wrote:
> ALSA: hda/ca0132: Fix buffer overflow in add_tuning_control
> 
> The 'sprintf' call in 'add_tuning_control' may exceed the 44-byte
> buffer if either string argument is too long. This triggers a compiler
> warning.
> Replaced 'sprintf' with 'snprintf' to limit string lengths to prevent
> overflow.
> 
> The Linux kernel CVE team has assigned CVE-2025-39751 to this issue.

While the change is good for defensive reasons, there isn't actually
any buffer overflow as it is to "fix".

The largest string possible is "Wedge Angle Playback Volume", whose
length is less than 44.

Thanks,
Siddh

[-- Attachment #2: This is a digitally signed message part --]
[-- Type: application/pgp-signature, Size: 833 bytes --]

       reply	other threads:[~2025-10-06  7:07 UTC|newest]

Thread overview: 4+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
     [not found] <2025091142-CVE-2025-39751-c340@gregkh>
2025-10-06  7:07 ` Siddh Raman Pant [this message]
2025-10-06  8:14   ` gregkh
2025-10-06  9:19     ` Siddh Raman Pant
2025-10-06  9:53       ` gregkh

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=f24f4524894417954b9de4ccec69c2e17aae3d5f.camel@oracle.com \
    --to=siddh.raman.pant@oracle.com \
    --cc=cve@kernel.org \
    --cc=gregkh@kernel.org \
    --cc=gregkh@linuxfoundation.org \
    --cc=linux-kernel@vger.kernel.org \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line before the message body. 
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox
all inboxes | Powered by JetHome®