CVE-2023-52697: ASoC: Intel: sof_sdw_rt_sdca_jack_common: ctx->headset_codec_dev = NULL
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: sofsdwrtsdcajackcommon: ctx->headsetcodecdev = NULL
sofsdwrtsdcajackexit() are used by different codecs, and some of them use the same dai name. For example, rt712 and rt713 both use "rt712-sdca-aif1" and sofsdwrtsdcajackexit(). As a result, sofsdwrtsdcajackexit() will be called twice by mcdailinkexitloop(). Set ctx->headsetcodecdev = NULL; after putdevice(ctx->headsetcodecdev); to avoid ctx->headsetcodecdev being put twice.
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ASoC: Intel: sofsdwrtsdcajackcommon: ctx->headsetcodecdev = NULL
The Linux kernel CVE team has assigned CVE-2023-52697 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024051755-CVE-2023-52697-1b7f@gregkh/T
— Red Hat
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.6.14 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.7.2 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 6.8 - Configuration
Set ctx->headset_codec_dev = NULL after put_device(ctx->headset_codec_dev) to prevent the device from being put twice.
Linux kernel ASoC Intel sof_sdw_rt_sdca_jack_common ctx->headset_codec_dev = NULL
Event History
Frequently Asked Questions
What is the severity of CVE-2023-52697?
CVE-2023-52697 has been classified with a severity rating that indicates potential risk to users of affected Linux kernel versions.
How do I fix CVE-2023-52697?
To fix CVE-2023-52697, update the Linux kernel to version 6.6.14, 6.7.2, 6.8, or specified remedial versions by Debian.
Which Linux kernel versions are affected by CVE-2023-52697?
CVE-2023-52697 affects various versions of the Linux kernel prior to 6.6.14 and various 6.1.x versions on Debian.
Can CVE-2023-52697 lead to system exploitation?
Yes, CVE-2023-52697 could potentially be exploited to impact system stability or security.
Is there a public disclosure for CVE-2023-52697?
CVE-2023-52697 is publicly documented, and details can be found through standard security vulnerability databases.