CVE-2023-52988
published 2025-03-27CVE-2023-52988: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()…
PriorityP337high7.8CVSS 3.1
AVLACLPRLUINSUCHIHAH
EPSS
0.27%
18.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_hda_get_connections() can return a negative error code.
It may lead to accessing 'conn' array at a negative index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.11-1 (bookworm) | linux 6.1.11-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < 437e50ef6290ac835d526d0e45f466a0aa69ba1b | 437e50ef6290ac835d526d0e45f466a0aa69ba1b |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < 6e1f586ddec48d71016b81acf68ba9f49ca54db8 | 6e1f586ddec48d71016b81acf68ba9f49ca54db8 |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < d6870f3800dbb212ae8433183ee82f566d067c6c | d6870f3800dbb212ae8433183ee82f566d067c6c |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < 2b557fa635e7487f638c0f030c305870839eeda2 | 2b557fa635e7487f638c0f030c305870839eeda2 |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < 1b9256c96220bcdba287eeeb90e7c910c77f8c46 | 1b9256c96220bcdba287eeeb90e7c910c77f8c46 |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < f011360ad234a07cb6fbcc720fff646a93a9f0d6 | f011360ad234a07cb6fbcc720fff646a93a9f0d6 |
| linux | linux | >= 30b4503378c976cf66201a1e81820519f6bd79ac < b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa | b9cee506da2b7920b5ea02ccd8e78a907d0ee7aa |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.178-1 | 5.10.178-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 0 < 6.1.11-1 | 6.1.11-1 |
| linux | linux_kernel | >= 3.1 < 4.14.306 | 4.14.306 |
| linux | linux_kernel | >= 4.15 < 4.19.273 | 4.19.273 |
| linux | linux_kernel | >= 4.20 < 5.4.232 | 5.4.232 |
| linux | linux_kernel | >= 5.11 < 5.15.93 | 5.15.93 |
| linux | linux_kernel | >= 5.16 < 6.1.11 | 6.1.11 |
| linux | linux_kernel | >= 5.5 < 5.10.168 | 5.10.168 |
CVSS provenance
nvdv3.17.8HIGHCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
osv7.8HIGH
vendor_debian7.8HIGH
vendor_redhat7.8HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
kernel: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
vendor_redhat·2025-03-27·CVSS 7.8
CVE-2023-52988 [HIGH] CWE-129 kernel: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
kernel: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_hda_get_connections() can return a negative error code.
It may lead to accessing 'conn' array at a negative index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
A vulnerability was found in the Linux kernel's ALSA subsystem in the `add_secret_dac_path()` function, where improper array handling can lead to out-of-bounds access. This occurs if the return value of the call to `snd_hda_get_connections()` returns an error code (a negative number), which is stored in the variable `nums` that is then used as the upper bound of a for loop used to acc
Debian
CVE-2023-52988: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/v...
vendor_debian·2023·CVSS 7.8
CVE-2023-52988 [HIGH] CVE-2023-52988: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/v...
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE.
Scope: local
bookworm: resolved (fixed in 6.1.11-1)
bullseye: resolved (fixed in 5.10.178-1)
forky: resolved (fixed in 6.1.11-1)
sid: resolved (fixed in 6.1.11-1)
trixie: resolved (fixed in 6.1.11-1)
GHSA
GHSA-4j5r-8cvm-p98h: In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_h
ghsa_unreviewed·2025-03-27
CVE-2023-52988 [HIGH] CWE-129 GHSA-4j5r-8cvm-p98h: In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_h
In the Linux kernel, the following vulnerability has been resolved:
ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path()
snd_hda_get_connections() can return a negative error code.
It may lead to accessing 'conn' array at a negative index.
Found by Linux Verification Center (linuxtesting.org) with SVACE.
OSV
CVE-2023-52988: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda
osv·2025-03-27·CVSS 7.8
CVE-2023-52988 [HIGH] CVE-2023-52988: In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda
In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE.
No detection rules found.
No public exploits indexed.
https://git.kernel.org/stable/c/1b9256c96220bcdba287eeeb90e7c910c77f8c46https://git.kernel.org/stable/c/2b557fa635e7487f638c0f030c305870839eeda2https://git.kernel.org/stable/c/437e50ef6290ac835d526d0e45f466a0aa69ba1bhttps://git.kernel.org/stable/c/6e1f586ddec48d71016b81acf68ba9f49ca54db8https://git.kernel.org/stable/c/b9cee506da2b7920b5ea02ccd8e78a907d0ee7aahttps://git.kernel.org/stable/c/d6870f3800dbb212ae8433183ee82f566d067c6chttps://git.kernel.org/stable/c/f011360ad234a07cb6fbcc720fff646a93a9f0d6
2025-03-27
Published