CVE-2024-50011

What it actually does

Missing empty sentinel entry in snd_soc_acpi_link_adr array causes hda_sdw_machine_select() loop termination test (!link->num_adr) to fail, resulting in continued iteration over invalid memory and potential use of uninitialized or out-of-bounds data during Intel SoundWire machine selection.

Why it matters to the business

Systems running affected Rocky Linux 8 container workloads or kernel builds may experience audio device misdetection or kernel instability on Intel platforms; widespread package exposure increases operational risk for containerized environments until updates are applied.

How an attack unfolds

An attacker with local access supplies crafted ACPI machine data or triggers SoundWire enumeration on vulnerable Intel hardware; the missing terminator allows the selection loop to read past array bounds, potentially leading to invalid machine matching or resource misuse in kernel audio initialization.

How to fix it

Update to the listed fixed package versions for each affected Rocky Linux 8 component (e.g., podman 0:3.0.1-6.module+el8.4.0+558+7340b765, runc 0:1.0.0-72.rc92.module+el8.5.0+661+c0df01f6, kernel commit aa3109ee91fe09e696274e6ac44813df8d13678f) and rebuild or restart dependent container services.

How to confirm the fix worked

Confirm updated package versions via rpm/dnf, verify kernel commit presence in /proc/version or source tree, and test SoundWire/ACPI machine selection on Intel RPL hardware to ensure loop termination occurs at the empty entry.

Typical attack path

1. Gain local execution on target system
2. Trigger audio/SoundWire device enumeration or ACPI table load
3. Cause loop to iterate beyond provided array entries
4. Read or act on invalid link data structures

How to detect it

Review kernel logs for audio/SoundWire initialization errors or unexpected machine selection; inspect dmesg and journalctl for hda_sdw_machine_select activity around boot or device hotplug events; correlate with container runtime restarts on affected Rocky Linux hosts.

What your security team should do

• Prioritize patching kernel and container runtime packages on all Rocky Linux 8 systems within maintenance windows
• Monitor EPSS and threat actor reports for any increase in Linux kernel audio-related exploits
• Restrict local user access on systems handling untrusted ACPI or hardware enumeration until patched