CVE-2024-50007

A flaw was found in the Linux kernel's Advanced Linux Sound Architecture (ALSA) High Performance Interface (ASIHPI) driver. This vulnerability allows a local attacker with administrative privileges to cause an out-of-bounds (OOB) array access. The driver processes responses from firmware without adequately validating array indices, which can lead to memory corruption. Successful exploitation could result in information disclosure or a denial of service (DoS).

This issue is considered to be a moderate impact flaw, as the exploitation for this will need an ADMIN (or ROOT) privilege (PR:H).

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

If the HPI audio hardware is not in use, prevent the asihpi kernel module from loading to mitigate this vulnerability. Create a file such as /etc/modprobe.d/disable-asihpi.conf with the following content:

install asihpi /bin/true

After creating the file, regenerate the initramfs and reboot the system for the changes to take effect. This action may impact functionality if HPI audio hardware is present and in use.