Memory Leak Vulnerability in Linux Kernel: ASoC SOF AMD Driver
Summary
DEBIAN-CVE-2023-52663: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: amd: Fix memory leak in amd_sof_acp_probe() Driver uses kasprintf() to initialize fw_{code,data}_bin members of struct acp_dev_data, but kfre... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device drivers. The ASoC (ALSA System on Chip) subsystem allows for audio processing on SoC devices, and the SOF (Sound Open Firmware) project aims to provide a flexible audio firmware solution. This vulnerability specifically affects the AMD SOF driver, which is responsible for audio processing on AMD hardware.
Vulnerability Detail
In the Linux kernel, a memory leak was identified in the ASoC SOF AMD driver. The issue arises from the use of the kasprintf() function to allocate memory for the fw_{code,data}_bin members of the struct acp_dev_data. However, the allocated memory is never deallocated using kfree(), leading to a memory leak. This vulnerability can result in increased memory consumption over time, potentially affecting system performance and stability. The fix involves switching to devm_kasprintf(), which automatically manages memory allocation and deallocation, ensuring that memory is freed when no longer needed.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
Currently, there are no specific workarounds provided for this vulnerability. The recommended action is to update to the patched version as soon as it is available.
Conclusion
The memory leak vulnerability in the ASoC SOF AMD driver of the Linux kernel poses a risk to system performance and stability. It is crucial to update to the patched version 6.7.12-1 to mitigate this issue. Regular monitoring and timely updates are essential for maintaining system security.
See every vulnerability recorded for linux →
FAQ
The memory leak can lead to increased memory usage over time, potentially degrading system performance and stability.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected.
Yes, a patch is available in version 6.7.12-1 of the Linux package for Debian 13 and 14.
While there are no specific workarounds, it is advisable to monitor your system's memory usage and apply the patch as soon as possible.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2023-52663.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
