CVE-2023-53788

In the Linux kernel, the following vulnerability has been resolved:

ALSA: hda/ca0132: fixup buffer overrun at tuning_ctl_set()

tuning_ctl_set() might have buffer overrun at (X) if it didn't break from loop by matching (A).

static int tuning_ctl_set(...)
{
	for (i = 0; i < TUNING_CTLS_COUNT; i++)

(A) if (nid == ca0132_tuning_ctls[i].nid) break;

	snd_hda_power_up(...);

(X) dspio_set_param(..., ca0132_tuning_ctls[i].mid, ...); snd_hda_power_down(...); ^

	return 1;
}

We will get below error by cppcheck

sound/pci/hda/patch_ca0132.c:4229:2: note: After for loop, i has value 12
 for (i = 0; i < TUNING_CTLS_COUNT; i++)
 ^
sound/pci/hda/patch_ca0132.c:4234:43: note: Array index out of bounds
 dspio_set_param(codec, ca0132_tuning_ctls[i].mid, 0x20,
                                           ^

This patch cares non match case.

The ca0132 HDA driver’s tuning_ctl_set() performs an array access even when the loop failed to find a matching nid, leading to an out-of-bounds read of ca0132_tuning_ctls[i]. A local user with access to ALSA mixer controls can trigger this via control writes, potentially causing a kernel crash (DoS) or undefined DSP parameter usage.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.