CVE-2024-27057: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
The Linux kernel CVE team has assigned CVE-2024-27057 to this issue.
Upstream advisory: https://lore.kernel.org/linux-cve-announce/2024050116-CVE-2024-27057-c0fb@gregkh/T
Other sources
In the Linux kernel, the following vulnerability has been resolved:
ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend
When the system is suspended while audio is active, the sofipc4pcmhwfree() is invoked to reset the pipelines since during suspend the DSP is turned off, streams will be re-started after resume.
If the firmware crashes during while audio is running (or when we reset the stream before suspend) then the sofipc4setmultipipelinestate() will fail with IPC error and the state change is interrupted. This will cause misalignment between the kernel and firmware state on next DSP boot resulting errors returned by firmware for IPC messages, eventually failing the audio resume. On stream close the errors are ignored so the kernel state will be corrected on the next DSP boot, so the second boot after the DSP panic.
If sofipc4triggerpipelines() is called from sofipc4pcmhwfree() then state parameter is SOFIPC4PIPERESET and only in this case.
Treat a forced pipeline reset similarly to how we treat a pcmfree by ignoring error on state sending to allow the kernel's state to be consistent with the state the firmware will have after the next boot.
— NVD
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2024-27057?
CVE-2024-27057 has been categorized as a moderate severity vulnerability in the Linux kernel.
How do I fix CVE-2024-27057?
To resolve CVE-2024-27057, update to the Linux kernel version 6.6.23, 6.7.11, or 6.8.
Which systems are affected by CVE-2024-27057?
CVE-2024-27057 affects various systems running vulnerable versions of the Linux kernel up to 6.6.23, 6.7.11, and 6.8.
What does CVE-2024-27057 address?
CVE-2024-27057 addresses a workaround for crashed firmware during system suspend in the ASoC: SOF IPC4 PCM module of the Linux kernel.
Is there a known exploit for CVE-2024-27057?
As of now, there are no known public exploits specific to CVE-2024-27057.