CVE-2023-54233

What it actually does

NULL pointer dereference in sof_ipc4_route_setup() when an IPC4 topology contains an unsupported widget whose .module_info field is unset, resulting in kernel Oops.

Why it matters to the business

Kernel crashes or panics on Linux systems using SOF audio drivers can cause unplanned downtime, data loss in audio workloads, and require manual intervention or reboots; low EPSS and no KEV status indicate limited active exploitation but still necessitates patching across kernel deployments.

How an attack unfolds

An attacker supplies a crafted IPC4 topology containing an unsupported widget; during route setup the missing module_info triggers dereference, causing kernel panic. No named threat actors or ransomware use reported.

How to fix it

Upgrade the Linux kernel to include commit 170818974e9732506195c6302743856cc8bdfd6f which adds the missing check for unsupported widgets.

How to confirm the fix worked

Confirm commit 170818974e9732506195c6302743856cc8bdfd6f is present in the kernel tree; test loading of IPC4 topologies with unsupported widgets and verify absence of Oops.

Typical attack path

1. Obtain ability to load custom ALSA/SOF topologies on target system
2. Construct IPC4 topology with unsupported widget type
3. Trigger topology load and route setup via audio subsystem
4. Induce NULL dereference leading to kernel Oops

How to detect it

Search kernel logs and Oops reports for references to sof_ipc4_route_setup or NULL dereference during ASoC IPC4 processing; correlate with recent topology load events.

• sof_ipc4_route_setup
• NULL dereference.*ASoC.*SOF
• module_info.*unset.*IPC4

What your security team should do

• Apply the referenced kernel commit or equivalent stable update immediately
• Audit systems for use of custom SOF topologies and restrict untrusted topology loading
• Monitor kernel logs for ASoC SOF related panics as a temporary detection measure