CVE-2023-52988

HIGH

Linux Kernel 3.1-4.14.305 - Out-of-Bounds Array Access in ALSA HDA Via add_secret_dac_path()

Title source: llm
STIX 2.1

Description

In the Linux kernel, the following vulnerability has been resolved: ALSA: hda/via: Avoid potential array out-of-bound in add_secret_dac_path() snd_hda_get_connections() can return a negative error code. It may lead to accessing 'conn' array at a negative index. Found by Linux Verification Center (linuxtesting.org) with SVACE.

References (7)

Core 7

Scores

CVSS v3 7.8
EPSS 0.0027
EPSS Percentile 18.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CISA SSVC

Vulnrichment
Exploitation none
Automatable no
Technical Impact total

Details

CWE
CWE-129
Status published
Products (24)
linux/Kernel 3.1.0 - 4.14.306linux
linux/Kernel 4.15.0 - 4.19.273linux
linux/Kernel 4.20.0 - 5.4.232linux
linux/Kernel 5.11.0 - 5.15.93linux
linux/Kernel 5.16.0 - 6.1.11linux
linux/Kernel 5.5.0 - 5.10.168linux
Linux/Linux < 3.1
Linux/Linux 3.1
Linux/Linux 30b4503378c976cf66201a1e81820519f6bd79ac - 1b9256c96220bcdba287eeeb90e7c910c77f8c46
Linux/Linux 30b4503378c976cf66201a1e81820519f6bd79ac - 2b557fa635e7487f638c0f030c305870839eeda2
... and 14 more
Published Mar 27, 2025
Tracked Since Feb 18, 2026