soundwire: fix enumeration completion (Linux Linux)

CVE-2023-54096
HIGH 7.8

En bref

Source
NVD
EPSS
EPSS 0.17 % · centile 6 ()
État
PUBLISHED
Publiée
Mise à jour
Attribuée par
Linux
Statut NVD
Deferred

Description

In the Linux kernel, the following vulnerability has been resolved: soundwire: fix enumeration completion The soundwire subsystem uses two completion structures that allow drivers to wait for soundwire device to become enumerated on the bus and initialised by their drivers, respectively. The code implementing the signalling is currently broken as it does not signal all current and future waiters and also uses the wrong reinitialisation function, which can potentially lead to memory corruption if there are still waiters on the queue. Not signalling future waiters specifically breaks sound card probe deferrals as codec drivers can not tell that the soundwire device is already attached when being reprobed. Some codec runtime PM implementations suffer from similar problems as waiting for enumeration during resume can also timeout despite the device already having been enumerated.

Références

Scores

VersionScoreVecteurÉvalué par
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HLinux
CVSS 3.1HIGH 7.8CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HNVD · 416baaa9-dc9f-4396-8d5f-8c081fb06d67 (Secondary)

Références européennes

Avis du CERT-FR

Produits affectés

ProduitVersions
Linux · Linuxaffected fb9469e54fa7a7b6a8137c40ae66c41b8d0ab175 < 48d1d0ce0782f995fda678508fdae35c5e9593f0 ; affected fb9469e54fa7a7b6a8137c40ae66c41b8d0ab175 < a36b522767f3a72688893a472e80c9aa03e67eda ; affected fb9469e54fa7a7b6a8137c40ae66c41b8d0ab175 < e1d54962a63b6ec04ed0204a3ecca942fde3a6fe ; affected fb9469e54fa7a7b6a8137c40ae66c41b8d0ab175 < c5265691cd065464d795de5666dcfb89c26b9bc1 ; affected fb9469e54fa7a7b6a8137c40ae66c41b8d0ab175 < c40d6b3249b11d60e09d81530588f56233d9aa44
Linux · Linuxaffected 5.7 ; unaffected 0 < 5.7 ; unaffected 5.10.190 ≤ 5.10.* ; unaffected 5.15.126 ≤ 5.15.* ; unaffected 6.1.43 ≤ 6.1.* ; unaffected 6.4.8 ≤ 6.4.*

Sources

SourceLicence
CVE List (CVEProject cvelistV5)CVE Program Terms of Use
EPSS (FIRST.org)FIRST — attribution requested
ENISA EUVDENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feedsPublic domain — this product uses data from the NVD API but is not endorsed or certified by the NVD