The Linux kernel ALSA firewire isight driver function isight_packet() took the sample count from the device iso packet and only checked it against the device's claimed iso length, which could be up to 0xffff. This allowed a sample count up to about 16379, while the payload samples buffer only held 2 * MAX_FRAMES_PER_PACKET values. Consequently, a sample count exceeding MAX_FRAMES_PER_PACKET could cause out-of-bounds reads from the payload and out-of-bounds writes to the PCM DMA buffer. The vulnerability could be triggered by a malicious or faulty Apple iSight device on the FireWire bus during normal capture. The fix added a bound on the sample count to MAX_FRAMES_PER_PACKET, preventing these out-of-bounds operations.

An attacker controlling a malicious or faulty Apple iSight device connected via FireWire could cause out-of-bounds memory reads and writes in the ALSA isight driver during normal audio capture. This could potentially lead to memory corruption or system instability. No known exploits in the wild have been reported.

A fix has been implemented in the Linux kernel to bound the sample count to MAX_FRAMES_PER_PACKET, preventing out-of-bounds memory access. Users should update to a Linux kernel version that includes this fix once available. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance.