CVE-2023-52697

What it actually does

Double put_device call on ctx->headset_codec_dev in sof_sdw_rt_sdca_jack_exit leads to use-after-free when the same DAI name triggers the exit handler twice via mc_dailink_exit_loop for codecs like rt712 and rt713.

Why it matters to the business

Kernel instability or potential local privilege escalation on systems using affected Intel SoundWire audio codecs, impacting 331 downstream dependents with remediation required before the 2024-05-17 publication window closes for high-prevalence Linux environments.

How an attack unfolds

An attacker with local access triggers repeated DAI link teardown for shared codec names, causing the jack exit routine to execute twice and freeing the headset codec device pointer a second time without the NULL guard, enabling use-after-free for memory corruption.

How to fix it

Update to fixed kernel commit a410d58117d6da4b7d41f3c91365f191d006bc3d or Ubuntu packages pillow 2.3.0-1ubuntu3.2 (14.04 LTS) and 3.1.1-1 (16.04 LTS); apply the NULL assignment after put_device in sof_sdw_rt_sdca_jack_common.

How to confirm the fix worked

Confirm presence of the NULL guard after put_device(ctx->headset_codec_dev) in sof_sdw_rt_sdca_jack_exit and verify kernel build includes a410d58117d6da4b7d41f3c91365f191d006bc3d; test repeated DAI exit paths do not double-free.

Typical attack path

1. Identify system with Intel ASoC SoundWire and rt712/rt713 codecs
2. Trigger audio jack or headset events that invoke sof_sdw_rt_sdca_jack_exit multiple times
3. Force mc_dailink_exit_loop to call the exit handler twice on the same context
4. Exploit the resulting use-after-free for kernel memory manipulation or denial of service

How to detect it

Review kernel logs for repeated put_device calls on headset_codec_dev or crashes in sof_sdw_rt_sdca_jack_exit; inspect audio subsystem traces for duplicate DAI link exits on rt712-sdca-aif1.

What your security team should do

• Prioritize kernel upgrades on all Intel SoundWire audio systems within 30 days given ecosystem prevalence
• Audit custom audio drivers for similar shared DAI exit patterns
• Monitor for local privilege escalation attempts post-remediation