CVE-2023-52674 - OpenCVE

In the Linux kernel, the following vulnerability has been resolved: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put() Ensure the value passed to scarlett2_mixer_ctl_put() is between 0 and SCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside scarlett2_mixer_values[].

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required Low

Scope Unchanged

Confidentiality Impact None

Integrity Impact None

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact partial

Vendors	Products
Redhat	Enterprise Linux

No data.

Package	CPE	Advisory	Released Date
Red Hat Enterprise Linux 9
kernel-0:5.14.0-503.11.1.el9_5	cpe:/a:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z
kernel-0:5.14.0-503.11.1.el9_5	cpe:/o:redhat:enterprise_linux:9	RHSA-2024:9315	2024-11-12T00:00:00Z

References

Link	Providers
https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572
https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7
https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea24850119847c2
https://git.kernel.org/stable/c/d8d8897d65061cbe36bf2909057338303a904810
https://git.kernel.org/stable/c/e517645ead5ea22c69d2a44694baa23fe1ce7c2b
https://lore.kernel.org/linux-cve-announce/2024051747-CVE-2023-52674-2aec@gregkh/T
https://nvd.nist.gov/vuln/detail/CVE-2023-52674
https://www.cve.org/CVERecord?id=CVE-2023-52674

History

Wed, 13 Nov 2024 02:45:00 +0000

Type	Values Removed	Values Added
First Time appeared		Redhat Redhat enterprise Linux
CPEs		cpe:/a:redhat:enterprise_linux:9 cpe:/o:redhat:enterprise_linux:9
Vendors & Products		Redhat Redhat enterprise Linux

Mon, 04 Nov 2024 15:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'partial'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: Linux

Published: 2024-05-17T14:24:40.049Z

Updated: 2024-11-06T15:50:30.527Z

Reserved: 2024-03-07T14:49:46.886Z

Link: CVE-2023-52674

Vulnrichment

Updated: 2024-08-02T23:11:34.394Z

NVD

Status : Awaiting Analysis

Published: 2024-05-17T15:15:18.187

Modified: 2024-11-06T16:35:09.330

Link: CVE-2023-52674

Redhat

Severity : Low

Publid Date: 2024-05-17T00:00:00Z

Links: CVE-2023-52674 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-52674", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "state": "PUBLISHED", "assignerShortName": "Linux", "dateReserved": "2024-03-07T14:49:46.886Z", "datePublished": "2024-05-17T14:24:40.049Z", "dateUpdated": "2024-11-06T15:50:30.527Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:50:53.271Z"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()\n\nEnsure the value passed to scarlett2_mixer_ctl_put() is between 0 and\nSCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside\nscarlett2_mixer_values[]."}], "affected": [{"product": "Linux", "vendor": "Linux", "defaultStatus": "unaffected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/mixer_scarlett2.c"], "versions": [{"version": "9e4d5c1be21f", "lessThan": "e517645ead5e", "status": "affected", "versionType": "git"}, {"version": "9e4d5c1be21f", "lessThan": "d8d8897d6506", "status": "affected", "versionType": "git"}, {"version": "9e4d5c1be21f", "lessThan": "03035872e178", "status": "affected", "versionType": "git"}, {"version": "9e4d5c1be21f", "lessThan": "ad945ea8d47d", "status": "affected", "versionType": "git"}, {"version": "9e4d5c1be21f", "lessThan": "04f8f053252b", "status": "affected", "versionType": "git"}]}, {"product": "Linux", "vendor": "Linux", "defaultStatus": "affected", "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "programFiles": ["sound/usb/mixer_scarlett2.c"], "versions": [{"version": "5.4", "status": "affected"}, {"version": "0", "lessThan": "5.4", "status": "unaffected", "versionType": "semver"}, {"version": "5.15.148", "lessThanOrEqual": "5.15.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.1.75", "lessThanOrEqual": "6.1.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.6.14", "lessThanOrEqual": "6.6.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.7.2", "lessThanOrEqual": "6.7.*", "status": "unaffected", "versionType": "semver"}, {"version": "6.8", "lessThanOrEqual": "*", "status": "unaffected", "versionType": "original_commit_for_fix"}]}], "references": [{"url": "https://git.kernel.org/stable/c/e517645ead5ea22c69d2a44694baa23fe1ce7c2b"}, {"url": "https://git.kernel.org/stable/c/d8d8897d65061cbe36bf2909057338303a904810"}, {"url": "https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572"}, {"url": "https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea24850119847c2"}, {"url": "https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7"}], "title": "ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()", "x_generator": {"engine": "bippy-9e1c9544281a"}}, "adp": [{"problemTypes": [{"descriptions": [{"type": "CWE", "lang": "en", "description": "CWE-noinfo Not enough information"}]}], "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"timestamp": "2024-05-31T18:43:58.630348Z", "id": "CVE-2023-52674", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-11-06T15:50:30.527Z"}}, {"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:34.394Z"}, "title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e517645ead5ea22c69d2a44694baa23fe1ce7c2b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d8d8897d65061cbe36bf2909057338303a904810", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea24850119847c2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7", "tags": ["x_transferred"]}]}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://git.kernel.org/stable/c/e517645ead5ea22c69d2a44694baa23fe1ce7c2b", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/d8d8897d65061cbe36bf2909057338303a904810", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea24850119847c2", "tags": ["x_transferred"]}, {"url": "https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T23:11:34.394Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "LOW", "confidentialityImpact": "NONE"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2023-52674", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2024-05-31T18:43:58.630348Z"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "description": "CWE-noinfo Not enough information"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-05-31T18:44:02.905Z"}}], "cna": {"title": "ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()", "affected": [{"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "9e4d5c1be21f", "lessThan": "e517645ead5e", "versionType": "git"}, {"status": "affected", "version": "9e4d5c1be21f", "lessThan": "d8d8897d6506", "versionType": "git"}, {"status": "affected", "version": "9e4d5c1be21f", "lessThan": "03035872e178", "versionType": "git"}, {"status": "affected", "version": "9e4d5c1be21f", "lessThan": "ad945ea8d47d", "versionType": "git"}, {"status": "affected", "version": "9e4d5c1be21f", "lessThan": "04f8f053252b", "versionType": "git"}], "programFiles": ["sound/usb/mixer_scarlett2.c"], "defaultStatus": "unaffected"}, {"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git", "vendor": "Linux", "product": "Linux", "versions": [{"status": "affected", "version": "5.4"}, {"status": "unaffected", "version": "0", "lessThan": "5.4", "versionType": "semver"}, {"status": "unaffected", "version": "5.15.148", "versionType": "semver", "lessThanOrEqual": "5.15.*"}, {"status": "unaffected", "version": "6.1.75", "versionType": "semver", "lessThanOrEqual": "6.1.*"}, {"status": "unaffected", "version": "6.6.14", "versionType": "semver", "lessThanOrEqual": "6.6.*"}, {"status": "unaffected", "version": "6.7.2", "versionType": "semver", "lessThanOrEqual": "6.7.*"}, {"status": "unaffected", "version": "6.8", "versionType": "original_commit_for_fix", "lessThanOrEqual": "*"}], "programFiles": ["sound/usb/mixer_scarlett2.c"], "defaultStatus": "affected"}], "references": [{"url": "https://git.kernel.org/stable/c/e517645ead5ea22c69d2a44694baa23fe1ce7c2b"}, {"url": "https://git.kernel.org/stable/c/d8d8897d65061cbe36bf2909057338303a904810"}, {"url": "https://git.kernel.org/stable/c/03035872e17897ba89866940bbc9cefca601e572"}, {"url": "https://git.kernel.org/stable/c/ad945ea8d47dd4454c271510bea24850119847c2"}, {"url": "https://git.kernel.org/stable/c/04f8f053252b86c7583895c962d66747ecdc61b7"}], "x_generator": {"engine": "bippy-9e1c9544281a"}, "descriptions": [{"lang": "en", "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()\n\nEnsure the value passed to scarlett2_mixer_ctl_put() is between 0 and\nSCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside\nscarlett2_mixer_values[]."}], "providerMetadata": {"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "shortName": "Linux", "dateUpdated": "2024-11-04T14:50:53.271Z"}}}, "cveMetadata": {"cveId": "CVE-2023-52674", "state": "PUBLISHED", "dateUpdated": "2024-11-06T15:50:30.527Z", "dateReserved": "2024-03-07T14:49:46.886Z", "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67", "datePublished": "2024-05-17T14:24:40.049Z", "assignerShortName": "Linux"}, "dataVersion": "5.1"}

{"affected_release": [{"advisory": "RHSA-2024:9315", "cpe": "cpe:/a:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}, {"advisory": "RHSA-2024:9315", "cpe": "cpe:/o:redhat:enterprise_linux:9", "package": "kernel-0:5.14.0-503.11.1.el9_5", "product_name": "Red Hat Enterprise Linux 9", "release_date": "2024-11-12T00:00:00Z"}], "bugzilla": {"description": "kernel: ALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()", "id": "2281336", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2281336"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.5", "cvss3_scoring_vector": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H", "status": "verified"}, "details": ["In the Linux kernel, the following vulnerability has been resolved:\nALSA: scarlett2: Add clamp() in scarlett2_mixer_ctl_put()\nEnsure the value passed to scarlett2_mixer_ctl_put() is between 0 and\nSCARLETT2_MIXER_MAX_VALUE so we don't attempt to access outside\nscarlett2_mixer_values[]."], "name": "CVE-2023-52674", "package_state": [{"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Out of support scope", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Under investigation", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "kernel-rt", "product_name": "Red Hat Enterprise Linux 9"}], "public_date": "2024-05-17T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2023-52674\nhttps://nvd.nist.gov/vuln/detail/CVE-2023-52674\nhttps://lore.kernel.org/linux-cve-announce/2024051747-CVE-2023-52674-2aec@gregkh/T"], "threat_severity": "Low", "upstream_fix": "kernel 5.15.148, kernel 6.1.75, kernel 6.6.14, kernel 6.7.2, kernel 6.8"}