Audio Stream Management Vulnerability in Linux Kernel Package
Summary
DEBIAN-CVE-2024-27057: In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for crashed firmware on system suspend When the system is suspended while audio is active, the sof_ipc4_pcm_hw_free() is... Affects linux versions < 6.7.12-1. Fixed in 6.7.12-1. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is the core component of the Linux operating system, responsible for managing hardware resources and providing essential services to applications. It supports a wide range of functionalities, including process management, memory management, and device control. The kernel is critical for system stability and performance. This specific vulnerability affects the Audio Stream Control (ASoC) subsystem, particularly the Sound Open Firmware (SOF) IPC4 PCM interface, which handles audio processing and stream management during system suspend states.
Vulnerability Detail
In the Linux kernel, a vulnerability has been identified in the ASoC subsystem related to the handling of audio streams during system suspend. When the system is suspended while audio is active, the function sof_ipc4_pcm_hw_free() is called to reset audio pipelines. If the firmware crashes during audio playback or when resetting the stream, it leads to an IPC error in the function sof_ipc4_set_multi_pipeline_state(). This error causes a misalignment between the kernel and firmware states, resulting in failures when resuming audio playback. The kernel ignores errors on stream closure, allowing the state to be corrected on the next DSP boot, but this can lead to audio resume failures and degraded user experience.
How To Fix
Minimum fixed version
6.7.12-1
This is the first release that contains the fix.
sudo apt-get install --only-upgrade linuxTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a workaround, users can avoid suspending the system while audio is active to prevent the firmware crash and subsequent IPC errors. This can be achieved by manually stopping audio playback before suspending the system.
Conclusion
The vulnerability in the Linux kernel's ASoC subsystem poses risks to audio playback during system suspend. Users are advised to update to the patched version to ensure system stability and performance. Temporary workarounds can mitigate the issue until an update can be applied.
See every vulnerability recorded for linux →
FAQ
The vulnerability can lead to audio playback failures after system resume, causing a poor user experience.
You can use Vulert, which monitors open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected without any signup.
Yes, updating to the patched version of the Linux kernel (6.7.12-1) resolves the vulnerability.
As a temporary measure, avoid suspending the system while audio is active to prevent the issue from occurring.
Detailed information can be found in the official Debian CVE database at https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2024-27057.json.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
