Executive brief
The Linux kernel's Qualcomm SoundWire driver contains a buffer overflow vulnerability in its port configuration handling. The vulnerable code indexes a 14-element array starting from 1 instead of 0, allowing writes beyond the buffer bounds and overwriting adjacent memory in the kernel. An attacker with local access could exploit this to corrupt kernel data structures and potentially achieve privilege escalation or denial of service.
Technical details
The vulnerability is a classic off-by-one buffer overflow in the Qualcomm SoundWire controller driver (drivers/soundwire/qcom.c). The 'qcom_swrm_ctrl->pconfig' array is declared with size QCOM_SDW_MAX_PORTS (14 elements), but the code indexes it starting from 1 to match real port numbers (1–14). This causes index 14 to write past the buffer boundary, overwriting the next struct member. The fix increases the array size to QCOM_SDW_MAX_PORTS + 1 to accommodate the 1-based indexing. Attack requires local kernel code execution context to trigger the vulnerable code path in qcom_swrm_get_port_config().
Affected products
- Linux Linux kernel Affected versions prior to fix commit 490937d479abe5f6584e69b96df066bc87be92e9
Timeline
- 2023-06-01: disclosed: Reported by kernel test robot and Dan Carpenter
- 2023-07-23: patched: Fix merged into stable tree by Greg Kroah-Hartman
- 2025-10-01: other: Published in NVD as CVE-2023-53465