greybus Topology OOB

Vulnerability analysis

When a Greybus audio module is connected, the kernel fetches a topology blob whose total size is reported by the module. The parser then walks this blob using separate section-size fields (for DAI, controls, widgets, and routes) that are also module-supplied, without verifying they fit within the fetched buffer. A malicious module can report a small topology size while claiming large section sizes, so the computed offsets point past the allocation and the kernel reads out of bounds. The fix adds a validation step that rejects any topology whose combined section sizes exceed the fetched blob size before parsing begins. The attack requires physical access to plug in a malicious Greybus audio module; no Linux user privileges are needed, but the Greybus staging driver and audio support must be enabled.