CVE-2023-54233

Vulnerability

Overview

The Linux kernel's ASoC SOF (Sound Open Firmware) subsystem contains a NULL pointer dereference vulnerability. The issue arises in sof_ipc4_route_setup() when processing an IPC4 topology that includes an unsupported widget. Such widgets lack a valid .module_info field, and the function attempts to dereference it without a prior check, leading to a kernel Oops.

Exploitation

Path

Exploitation requires the ability to load a crafted IPC4 topology into the SOF driver. This typically necessitates local access or the ability to trigger a firmware load with a malicious topology file. No authentication is needed beyond the ability to interact with the ALSA subsystem. The attack surface is limited to systems using the SOF driver with IPC4 support.

Impact

A successful exploit causes a kernel NULL pointer dereference, resulting in a denial of service (system crash or reboot). There is no evidence of privilege escalation or arbitrary code execution from this vulnerability.

Mitigation

The issue was fixed in the Linux kernel with commit e3720f92e023. Users should apply the patch from the stable kernel tree or update to a kernel version containing the fix [1].