{"dataType":"CVE_RECORD","dataVersion":"5.2","cveMetadata":{"cveId":"CVE-2024-46863","assignerOrgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","state":"PUBLISHED","assignerShortName":"Linux","dateReserved":"2024-09-11T15:12:18.293Z","datePublished":"2024-09-27T12:42:52.373Z","dateUpdated":"2026-08-05T11:39:06.428Z"},"containers":{"cna":{"providerMetadata":{"orgId":"416baaa9-dc9f-4396-8d5f-8c081fb06d67","shortName":"Linux","dateUpdated":"2026-08-05T11:39:06.428Z"},"descriptions":[{"lang":"en","value":"In the Linux kernel, the following vulnerability has been resolved:\n\nASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item\n\nThere is no links_num in struct snd_soc_acpi_mach {}, and we test\n!link->num_adr as a condition to end the loop in hda_sdw_machine_select().\nSo an empty item in struct snd_soc_acpi_link_adr array is required."}],"metrics":[{"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:H","baseScore":7.3,"baseSeverity":"HIGH"},"scenarios":[{"lang":"en","value":"AV:L - The out-of-bounds walk occurs inside the SOF/HDA PCI driver probe path (`hda_sdw_machine_select`) and the `sof_sdw` machine driver, which are reachable only in the local system context — there is no network, packet, or remote-peer input feeding this code. Re-triggering it requires local driver bind/rebind or a reboot of the affected Lunar Lake platform.\nAC:L - On an affected platform (Intel LNL with a cs42l43 on SoundWire link 0) the unterminated array is walked deterministically on every probe, with no race, timing window, or memory-layout grooming required. There are no conditions the attacker must win or wait for.\nPR:L - No authentication or capability check gates the code — it runs during device probe — but deliberately causing the probe to re-execute (module load or `/sys/bus/pci/drivers/.../bind`) requires local system access. No remote credentials or user-namespace escalation are involved.\nUI:N - The vulnerable loop executes automatically during driver probe at boot; no victim must open a file, mount a filesystem, or take any action.\nS:U - Both the defective data and the faulting reads are within the kernel's own security authority; nothing crosses a VM, IOMMU, or sandbox boundary.\nC:H - This is an out-of-bounds read that is not confined to a few bytes: `hda_sdw_machine_select` reads up to three 16-byte structs past the array, and the OOB-derived `adr_d`/`name_prefix` pointers are then dereferenced in `snd_soc_acpi_sdw_link_slaves_found()` and `parse_sdw_endpoints()`, allowing kernel memory at an uncontrolled address to be read. In the `sof_sdw` path the walk is entirely unbounded and OOB `name_prefix` strings can surface in DAI-link/component names exposed to userspace via /proc/asound and sysfs.\nI:L - There is no out-of-bounds write or arbitrary-write primitive, but the kernel selects the audio machine driver, topology firmware file, and constructs DAI-link/endpoint structures from data read past the end of the array, so kernel state and device configuration are derived from invalid memory.\nA:H - The OOB entry supplies both a `num_adr` count and an `adr_d` pointer that are dereferenced without validation, so a neighbouring `.rodata` object that is not a valid `snd_soc_acpi_link_adr` produces a wild-pointer read and a kernel oops at probe time; the unbounded walk in `sof_sdw.c` compounds this. On the observed layout the machine fails to match, causing complete loss of audio functionality on affected devices."}]}],"affected":[{"product":"Linux","vendor":"Linux","defaultStatus":"unaffected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/intel/common/soc-acpi-intel-lnl-match.c"],"versions":[{"version":"dd3bd9dc47084195fcb3c1b371cb03046abb13ab","lessThan":"8eb57389d8ad91c67bf844f5aae4caef74b9091b","status":"affected","versionType":"git"},{"version":"dd3bd9dc47084195fcb3c1b371cb03046abb13ab","lessThan":"c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796","status":"affected","versionType":"git"}]},{"product":"Linux","vendor":"Linux","defaultStatus":"affected","repo":"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git","programFiles":["sound/soc/intel/common/soc-acpi-intel-lnl-match.c"],"versions":[{"version":"6.10","status":"affected"},{"version":"0","lessThan":"6.10","status":"unaffected","versionType":"semver"},{"version":"6.10.11","lessThanOrEqual":"6.10.*","status":"unaffected","versionType":"semver"},{"version":"6.11","lessThanOrEqual":"*","status":"unaffected","versionType":"original_commit_for_fix"}]}],"cpeApplicability":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.10.11"},{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionStartIncluding":"6.10","versionEndExcluding":"6.11"}]}]}],"references":[{"url":"https://git.kernel.org/stable/c/8eb57389d8ad91c67bf844f5aae4caef74b9091b"},{"url":"https://git.kernel.org/stable/c/c4246f1fe9f24f8dcd97887ed67d8fcfd91f4796"}],"title":"ASoC: Intel: soc-acpi-intel-lnl-match: add missing empty item","x_generator":{"engine":"bippy-1.2.0"}},"adp":[{"metrics":[{"other":{"type":"ssvc","content":{"timestamp":"2024-09-29T13:45:58.346254Z","id":"CVE-2024-46863","options":[{"Exploitation":"none"},{"Automatable":"no"},{"Technical Impact":"partial"}],"role":"CISA Coordinator","version":"2.0.3"}}}],"title":"CISA ADP Vulnrichment","providerMetadata":{"orgId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","shortName":"CISA-ADP","dateUpdated":"2024-09-29T13:49:05.489Z"}}]}}