CVE-2023-52674

What it actually does

Missing bounds check in scarlett2_mixer_ctl_put() allows an out-of-range value to index scarlett2_mixer_values[] array, causing a buffer overflow in the Linux kernel ALSA driver.

Why it matters to the business

Systems using Focusrite Scarlett2 audio interfaces may experience kernel crashes, denial of service, or potential local privilege escalation, disrupting audio workflows and requiring system restarts or patches.

How an attack unfolds

An attacker with local access to the ALSA mixer controls supplies a value outside 0..SCARLETT2_MIXER_MAX_VALUE; the kernel writes or reads beyond the array bounds, which can corrupt adjacent memory and lead to arbitrary code execution or panic.

How to fix it

Upgrade the Linux kernel to a version containing commit e517645ead5ea22c69d2a44694baa23fe1ce7c2b which adds the required clamp() call in scarlett2_mixer_ctl_put().

How to confirm the fix worked

Verify the presence of the clamp() statement in scarlett2_mixer_ctl_put() in the running kernel source or confirm the kernel build includes commit e517645ead5ea22c69d2a44694baa23fe1ce7c2b.

Typical attack path

1. Obtain local user access on a Linux system with Scarlett2 hardware or the driver loaded
2. Open the ALSA mixer control interface for scarlett2
3. Invoke scarlett2_mixer_ctl_put() with an out-of-bounds integer value
4. Trigger kernel memory corruption leading to crash or RCE

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops/panic entries mentioning scarlett2_mixer_ctl_put or out-of-bounds array access; correlate with user processes that recently accessed ALSA mixer controls.

What your security team should do

• Apply the fixed kernel commit or distribution update as soon as possible on any host exposing ALSA scarlett2 controls
• Restrict unprivileged local access to audio mixer devices until patched
• Monitor for kernel oops or panic logs referencing scarlett2_mixer