PT-2025-13333 · Linux+2 · Linux Kernel+2

Published 2023-01-19 · Updated 2025-05-28 · CVE-2023-52987

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description A vulnerability has been resolved in the Linux kernel related to the ASoC: SOF: ipc4-mtrace component. The issue involves preventing an underflow in the sof ipc4 priority mask dfs write() function. The id variable, which comes from the user, was changed to an unsigned type to prevent an array underflow.

Recommendations For the affected Linux kernel versions, consider updating to a version that includes the fix for the sof ipc4 priority mask dfs write() function underflow issue. As a temporary workaround, consider restricting the input for the id variable to prevent potential underflow exploitation.

Exploit

Fix

Integer Underflow

Improper Validation of Array Index

Weakness Enumeration

CWE-191

CWE-129

Related Identifiers

BDU:2025-06235

CVE-2023-52987

Affected Products

Astra Linux

Linux Kernel

Red Os

References · 19

• 🔥 https://github.com/CVEProject/cvelistV5/tree/main/cves/2023/52xxx/CVE-2023-52987.json · Exploit
• https://ubuntu.com/security/CVE-2023-52987 · Vendor Advisory
• https://git.kernel.org/stable/c/ea57680af47587397f5005d7758022441ed66d54 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2023-52987 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2023-52987 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2023-52987 · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2023-52987 · Vendor Advisory
• https://git.kernel.org/stable/c/d52f34784e4e2f6e77671a9f104d8a69a3b5d24c · Patch
• https://nvd.nist.gov/vuln/detail/CVE-2023-52987 · Security Note
• https://cve.org/CVERecord?id=CVE-2023-52987 · Security Note
• https://osv.dev/vulnerability/BELL-CVE-2023-52987 · Vendor Advisory
• https://bdu.fstec.ru/vul/2025-06235 · Security Note
• https://docs.bell-sw.com/security/cves/CVE-2023-52987 · Note
• https://redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-kernel-lt-280525/?sphrase_id=1000202 · Note
• https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git · Note