CVE-2023-52663

What it actually does

Memory leak in amd_sof_acp_probe() where kasprintf allocates fw_code_bin and fw_data_bin without corresponding kfree, allowing unbounded heap growth until allocation failure.

Why it matters to the business

Prolonged operation of affected audio hardware can exhaust kernel memory, causing system instability, application crashes, or denial of service on Linux systems using the AMD ACP SOF driver.

How an attack unfolds

An attacker with local access repeatedly triggers device probe or module load/unload paths that call amd_sof_acp_probe, accumulating leaked allocations until memory pressure leads to denial of service; no remote or unauthenticated path exists.

How to fix it

Apply kernel patches that replace kasprintf with devm_kasprintf and add NULL checks; reboot after update. For distributions, install the corrected package versions that include this fix.

How to confirm the fix worked

Confirm the patched source contains devm_kasprintf calls with pointer checks; run memory-leak detection tools such as kmemleak during probe/unprobe cycles and verify no growth in the affected structures.

Typical attack path

1. Obtain local user or kernel module privileges on affected system
2. Trigger repeated probe or audio device initialization events
3. Monitor for memory exhaustion and resulting denial of service

How to detect it

Review kernel logs for repeated allocation warnings or OOM killer activity tied to audio probe paths; inspect slabinfo or kmemleak reports for growth in acp_dev_data allocations.

What your security team should do

• Prioritize patching systems exposing audio hardware using the AMD ACP SOF driver
• Monitor EPSS and exploit maturity; currently low but re-evaluate after any public PoC
• Apply defense-in-depth memory accounting and container limits to limit blast radius of local leaks