CVE-2023-53666

What it actually does

Missing error handling after MBHC initialization in wcd938x codec allows later code paths to dereference an error pointer, resulting in an invalid kernel memory access and crash during jack configuration.

Why it matters to the business

Systems using affected Qualcomm audio hardware may experience unexpected kernel crashes during audio device initialization or jack detection, leading to loss of audio functionality and potential denial of service on embedded or laptop platforms.

How an attack unfolds

An attacker with local access triggers snd_soc_component_set_jack through normal audio subsystem initialization or user actions that invoke jack setup on affected hardware; the missing check after a failing wcd_mbhc_init call causes wcd_mbhc_start to receive an error pointer and crash the kernel.

How to fix it

Update the Linux kernel to a version containing commit 5a34d252052b5da743ef82591c860fc947384d4e or later stable equivalent; rebuild and deploy the updated kernel image on affected devices.

How to confirm the fix worked

Confirm the fix by inspecting the wcd938x_codec_set_jack function for proper error checking after wcd_mbhc_init, or verify the running kernel contains the referenced commit hash; test jack setup on hardware that previously triggered the fault.

Typical attack path

1. Load or probe the snd_soc_wcd938x and snd_soc_wcd_mbhc modules on vulnerable kernel
2. Invoke qcom_snd_wcd_jack_setup or equivalent during snd_soc_register_card
3. MBHC initialization fails and returns an error pointer without being checked
4. Subsequent call to wcd_mbhc_start dereferences the error pointer
5. Kernel paging fault occurs at invalid address causing oops or panic

How to detect it

Search kernel logs and dmesg for the exact panic string 'Unable to handle kernel paging request at virtual address fffffffffffffff8' along with call traces containing wcd_mbhc_start, wcd938x_codec_set_jack, and snd_soc_component_set_jack; correlate with boot or audio initialization events.

• Unable to handle kernel paging request at virtual address fffffffffffffff8
• wcd_mbhc_start+0x28/0x380 [snd_soc_wcd_mbhc]
• wcd938x_codec_set_jack+0x28/0x48 [snd_soc_wcd938x]
• qcom_snd_wcd_jack_setup
• sc8280xp_snd_init

What your security team should do

• Prioritize kernel upgrade on all systems containing the wcd938x codec
• Monitor kernel logs for wcd_mbhc_start and snd_soc_wcd938x oops signatures until patched
• Restrict local user access on unpatched multi-user systems until remediation is complete