CVE-2023-54245
Slab-Out-of-Bounds in Linux ASoC tx-macro Codec
Publication date: 2025-12-30
Last updated on: 2025-12-30
Assigner: kernel.org
Description
Description
CVSS Scores
EPSS Scores
| Probability: | |
| Percentile: |
Meta Information
Affected Vendors & Products
| Vendor | Product | Version / Range |
|---|---|---|
| linux | kernel | * |
Helpful Resources
Exploitability
| CWE ID | Description |
|---|---|
| CWE-UNKNOWN |
Attack-Flow Graph
AI Powered Q&A
Can you explain this vulnerability to me?
This vulnerability is a slab-out-of-bounds read in the Linux kernel's ASoC codec driver for tx-macro. It occurs in the function regcache_flat_read, causing a read beyond the allocated memory (out-of-bounds). The issue was triggered during testing with syzkaller and is related to the use of an unnecessarily large 32-bit variable where an 8-bit variable (u8) would suffice, leading to the out-of-bounds access. The fix involved limiting the variable size to u8 to prevent this memory access error.
How can this vulnerability impact me? :
This vulnerability can lead to out-of-bounds memory reads in the Linux kernel, which may cause system instability, crashes, or potentially expose sensitive kernel memory contents. Such memory errors can be exploited to compromise system security or cause denial of service.
How can this vulnerability be detected on my network or system? Can you suggest some commands?
This vulnerability can be detected by running the syzkaller fuzzer, which triggers the KASAN slab-out-of-bounds error in the regcache_flat_read function. The detection involves observing KASAN reports with backtraces similar to the one described, indicating out-of-bounds reads. Specific commands are not provided in the available information.
What immediate steps should I take to mitigate this vulnerability?
Immediate mitigation involves applying the fix that limits the variable type to u8 (short type) to prevent the out-of-bounds access in the tx-macro codec. Since this is a kernel vulnerability, updating the Linux kernel to a version that includes this fix is recommended.