CVE-2024-43896

What it actually does

NULL pointer dereference crash when efi.get_variable is called without first verifying its existence via efi_rt_services_supported() in the cs-amp-lib ASoC driver.

Why it matters to the business

Unexpected kernel crashes or reboots on Linux-based systems and Android devices during audio initialization, leading to operational downtime and potential loss of service on servers, embedded platforms, or mobile devices.

How an attack unfolds

An attacker triggers audio subsystem initialization on a system where EFI runtime services lack the get_variable function; the missing NULL check causes an immediate kernel panic, resulting in denial of service without requiring elevated privileges beyond normal audio access.

How to fix it

Upgrade the Linux kernel to a version containing commit 5b6baaa7cbd77ff980516bad38bbc5a648bb5158 or later; for affected Android builds update platform/frameworks/base to the 2022-11-01 release or newer.

How to confirm the fix worked

Confirm the source change that adds an efi_rt_services_supported() guard before any efi.get_variable call in cs-amp-lib.c and test audio initialization on EFI systems with limited runtime services.

Typical attack path

1. Gain local access or trigger audio events on the target system
2. Initiate ASoC cs-amp-lib driver loading or codec probe
3. Invoke path that calls efi.get_variable without prior efi_rt_services_supported() check
4. Trigger NULL pointer dereference resulting in kernel crash

How to detect it

Review kernel logs and oops reports for NULL pointer dereference entries mentioning cs-amp-lib or EFI variable access during audio driver initialization.

What your security team should do

• Apply the listed kernel and Android framework updates as the primary fix
• Reboot systems after patching and monitor for audio-related kernel panics during normal operation
• Prioritize patching on devices that rely on EFI runtime services for audio hardware