CVE-2023-52736

published 2024-05-21

CVE-2023-52736: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Do not unset preset when cleaning up codec Several functions that take part in…

Priority P4 20 medium 5.5 CVSS 3.1

AV L AC L PR L UI N S U C N I N A H

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda: Do not unset preset when cleaning up codec

Several functions that take part in codec's initialization and removal
are re-used by ASoC codec drivers implementations. Drivers mimic the
behavior of hda_codec_driver_probe/remove() found in
sound/pci/hda/hda_bind.c with their component->probe/remove() instead.

One of the reasons for that is the expectation of
snd_hda_codec_device_new() to receive a valid pointer to an instance of
struct snd_card. This expectation can be met only once sound card
components probing commences.

As ASoC sound card may be unbound without codec device being actually
removed from the system, unsetting ->preset in
snd_hda_codec_cleanup_for_unbind() interferes with module unload -> load
scenario causing null-ptr-deref. Preset is assigned only once, during
device/driver matching whereas ASoC codec driver's module reloading may
occur several times throughout the lifetime of an audio stack.

Affected

14 ranges

Vendor	Product	Version range	Fixed in
debian	linux	< linux 6.1.15-1 (bookworm)	linux 6.1.15-1 (bookworm)
linux	linux	—	—
linux	linux	>= 9a6246ff78ac33af78f82704cde6fec361597eea < 7fc4e7191eae9d9325511e03deadfdb2224914f8	7fc4e7191eae9d9325511e03deadfdb2224914f8
linux	linux	>= 9a6246ff78ac33af78f82704cde6fec361597eea < e909f5f2aa55a8f9aa6919cce08015cb0e8d4668	e909f5f2aa55a8f9aa6919cce08015cb0e8d4668
linux	linux	>= 9a6246ff78ac33af78f82704cde6fec361597eea < 427ca2530da8dc61a42620d7113b05e187b6c2c0	427ca2530da8dc61a42620d7113b05e187b6c2c0
linux	linux	>= 9a6246ff78ac33af78f82704cde6fec361597eea < 87978e6ad45a16835cc58234451111091be3c59a	87978e6ad45a16835cc58234451111091be3c59a
linux	linux_kernel	< 5.10.169	5.10.169
linux	linux_kernel	—	—
linux	linux_kernel	>= 0 < 5.10.178-1	5.10.178-1
linux	linux_kernel	>= 0 < 6.1.15-1	6.1.15-1
linux	linux_kernel	>= 0 < 6.1.15-1	6.1.15-1
linux	linux_kernel	>= 0 < 6.1.15-1	6.1.15-1
linux	linux_kernel	>= 5.11 < 5.15.95	5.15.95
linux	linux_kernel	>= 5.16 < 6.1.13	6.1.13

CVSS provenance

nvd v3.1 5.5 MEDIUM CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

osv 5.5 MEDIUM

vendor_debian 5.5 MEDIUM

vendor_redhat 5.5 MEDIUM

Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-476 CWE-459