CVE-2024-39473

What it actually does

NULL pointer dereference in ASoC SOF IPC4 topology handling when a process module lacks the base config extension and crafted topology/sequences are supplied, resulting in a kernel crash.

Why it matters to the business

Local denial-of-service that can interrupt audio pipelines and force system reboots or application restarts on affected devices.

How an attack unfolds

An attacker with local access supplies a specially crafted ALSA topology file and playback sequence that exercises process modules without base extensions, triggering the NULL dereference in the kernel driver.

How to fix it

Upgrade the Linux kernel or affected GStreamer packages to a version containing the fix (e.g., gst-plugins-bad1.0 1.18.4-3+deb11u2, 1.22.0-4+deb12u2, 1.22.7-1, or the kernel commit ddb4fbe43149b157efb52b6472313f48308c1dbc).

How to confirm the fix worked

Confirm the running kernel or GStreamer package version matches or exceeds the listed fixed releases and test with known topology files that previously triggered the NULL dereference.

Typical attack path

1. Obtain local user access on a system using the vulnerable SOF IPC4 driver
2. Load or replace an ALSA topology configuration that omits base config extensions for process modules
3. Trigger audio processing with a crafted sequence that queries input formats
4. Cause kernel NULL dereference leading to panic or process termination

How to detect it

Review kernel logs for NULL pointer dereference oops messages originating from the SOF IPC4 topology code path around the time of audio-related crashes.

What your security team should do

• Prioritize patching systems that expose audio processing to untrusted topology files
• Apply the listed fixed package versions immediately on Debian and other distributions
• Restrict local user ability to load custom ALSA topologies until patches are deployed