Description

The Intel ALH digital-audio-interface driver function dai_alh_get_properties() in drivers/dai/intel/alh/alh.c used a caller-supplied int stream_id with no range validation. The value indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address, so an out-of-range stream_id produces an out-of-bounds read of one byte at an attacker-chosen signed offset from the array. That byte is written into prop->dma_hs_id and the resulting struct dai_properties is copied back to the caller, leaking it. dai_get_properties_copy() is a Zephyr __syscall, and its verifier z_vrfy_dai_get_properties_copy() (drivers/dai/dai_handlers.c) validates only the device-object permission and the destination buffer, not stream_id. A user-mode thread that has been granted access to the ALH DAI device object can therefore call the syscall with an arbitrary stream_id, crossing the userspace/kernel sandbox boundary. The impact is a one-byte-per-call arbitrary-offset kernel information disclosure (and leakage of a computed kernel address via fifo_address); a stream_id that resolves to an unmapped page faults in kernel context, giving a local denial of service. Exploitation requires CONFIG_USERSPACE and device access, making this a local, moderate-severity issue. The fix rejects negative and too-large stream_id values up front and returns NULL, which the copy wrapper maps to -ENOENT.

Executive Summary

Technical Details

Mitigations

References

Additional Metadata

{
  "score": "6.1",
  "pubDate": "2026-08-12T05:17:41.860Z",
  "pubdate": "2026-08-12T05:17:41.860Z",
  "executiveSummary": "An out-of-bounds read vulnerability exists in the Intel ALH digital-audio-interface driver function dai_alh_get_properties() located within drivers/dai/intel/alh/alh.c. The vulnerability stems from a lack of input validation on a caller-supplied int stream_id parameter, which is used directly to index the fixed-size static const uint8_t alh_handshake_map[64] array and scale a FIFO register address. Because Zephyr's syscall verifier z_vrfy_dai_get_properties_copy() in drivers/dai/dai_handlers.c validates only device-object permissions and destination buffers while omitting checks for stream_id, a user-mode thread with access to the ALH DAI device object can supply an arbitrary index. Exploitation results in a one-byte-per-call arbitrary-offset kernel information disclosure, leakage of computed kernel addresses via fifo_address, and potential local denial of service via kernel page faults if the stream_id resolves to an unmapped page. This is a moderate-severity, local issue requiring CONFIG_USERSPACE and device access.",
  "technicalDetails": "The vulnerability resides in the Intel ALH digital-audio-interface driver component, specifically within the dai_alh_get_properties() function in drivers/dai/intel/alh/alh.c. The root cause is the absence of range validation for the caller-supplied int stream_id variable. This parameter performs a dual role: it indexes the fixed-size static const uint8_t alh_handshake_map[64] array and scales a FIFO register address.\nWhen an unvalidated stream_id is processed, an out-of-bounds read occurs, reading a single byte at an attacker-chosen signed offset from the alh_handshake_map array. This retrieved byte is subsequently assigned to prop->dma_hs_id within the resulting struct dai_properties. The structure is then copied back to the caller, directly leaking kernel memory contents. Furthermore, the computed fifo_address leaks kernel memory addressing information.\nThe attack flow crosses the userspace/kernel sandbox boundary via the dai_get_properties_copy() Zephyr __syscall. The associated syscall verifier, z_vrfy_dai_get_properties_copy() located in drivers/dai/dai_handlers.c, fails to validate the stream_id parameter, checking only the device-object permissions and the destination buffer. An attacker with a user-mode thread granted access to the ALH DAI device object can invoke the syscall with an arbitrary stream_id.\nIf the attacker provides a stream_id that points to valid kernel memory outside the bounds of the array, a one-byte information disclosure occurs per call. If the crafted stream_id resolves to an unmapped memory page, it triggers a kernel page fault, resulting in a local denial of service. The attack requires local execution, CONFIG_USERSPACE enabled, and pre-existing access to the ALH DAI device object, eliminating any network exposure vectors."
}