CVE-2023-53465

In the Linux kernel, the following vulnerability has been resolved:

soundwire: qcom: fix storing port config out-of-bounds

The 'qcom_swrm_ctrl->pconfig' has size of QCOM_SDW_MAX_PORTS (14), however we index it starting from 1, not 0, to match real port numbers. This can lead to writing port config past 'pconfig' bounds and overwriting next member of 'qcom_swrm_ctrl' struct. Reported also by smatch:

drivers/soundwire/qcom.c:1269 qcom_swrm_get_port_config() error: buffer overflow 'ctrl->pconfig' 14 <= 14

This vulnerability is rated as Moderate severity for Red Hat Enterprise Linux because exploitation requires access to systems configured with specific Qualcomm SoundWire hardware. Qualcomm SoundWire audio controllers are uncommon in standard enterprise server and cloud deployments, significantly narrowing the attack surface. Under specific hardware configurations, a local attacker could trigger an out-of-bounds write to corrupt adjacent kernel memory structures, leading to a system crash or privilege escalation.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.