CVE-2023-52674: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()
In the Linux kernel, the following vulnerability has been resolved:
ALSA: scarlett2: Add clamp() in scarlett2mixerctlput()
Ensure the value passed to scarlett2mixerctlput() is between 0 and SCARLETT2MIXERMAXVALUE so we don't attempt to access outside scarlett2mixervalues[].
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ALSA: scarlett2: Add clamp() in scarlett2mixerctlput()
The Linux kernel CVE team has assigned CVE-2023-52674 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051747-CVE-2023-52674-2aec@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 5.15.148 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.1.75 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.14 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Upgrade
Upgrade
Linux kernel ALSA scarlett2to a version that resolves this vulnerability.Patch CVE-2023-52674
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52674?
CVE-2023-52674 is classified as a medium severity vulnerability in the Linux kernel.
How do I fix CVE-2023-52674?
To fix CVE-2023-52674, update your kernel to version 5.15.148, 6.1.75, 6.6.14, 6.7.2, 6.8, or appropriate patched versions provided by your distribution.
What does CVE-2023-52674 affect?
CVE-2023-52674 affects the ALSA subsystem and specifically the scarlett2 mixer control functionality in the Linux kernel.
When was CVE-2023-52674 disclosed?
CVE-2023-52674 was disclosed in 2023 as part of a security update for the Linux kernel.
What are the risks of not addressing CVE-2023-52674?
Failure to address CVE-2023-52674 could potentially allow for out-of-bounds access, leading to instability or security risks in systems utilizing affected kernel versions.