CVE-2023-52904

What it actually does

NULL pointer dereference in ALSA usb-audio driver when snd_usb_pcm_has_fixed_rate receives a NULL subs argument and dereferences it before the NULL check, resulting in kernel memory corruption or panic.

Why it matters to the business

Unexpected kernel crashes on systems using USB audio devices can interrupt operations, reduce availability, and require reboots; low exploitability and absence from KEV limit immediate targeted risk but patching remains necessary for stability across Linux and Android deployments.

How an attack unfolds

An attacker supplies or emulates a USB audio device that triggers audio PCM rate handling paths, causing the vulnerable function to be invoked with a NULL subs pointer and dereference it before validation.

How to fix it

Upgrade Linux kernel to 5.15.168 or apply commit f57204edc10760c935d8d36ea999dc8acf018030; update affected Android frameworks/base releases to the 2022-05-01 fixed versions for API levels 10, 11, 12, and 12L.

How to confirm the fix worked

Confirm kernel version is at or above the fixed release, inspect the snd_usb_pcm_has_fixed_rate function for the NULL check on subs before use, and verify no oops entries reference the function after USB audio activity.

Typical attack path

1. Gain local access or physical proximity to attach a USB device
2. Present a USB audio interface that exercises snd_usb_pcm_has_fixed_rate
3. Force the function call with NULL subs argument
4. Trigger NULL dereference leading to kernel panic or corruption

How to detect it

Review kernel logs and dmesg for oops or panic messages containing snd_usb_pcm_has_fixed_rate or usb-audio NULL pointer dereference around USB device attach or audio PCM initialization events.

What your security team should do

• Apply kernel and Android updates to the listed fixed versions immediately on systems exposing USB audio
• Monitor kernel logs for ALSA-related NULL dereference panics until patches are deployed
• Restrict untrusted USB audio devices on high-value systems pending remediation