CVE-2023-52697: 
Linux Kernel vulnerability analysis and mitigation

CVE-2023-52697 affects the Linux kernel's ASoC (ALSA System on Chip) Intel sound driver. The vulnerability was discovered and disclosed in May 2024, specifically impacting the sof_sdw_rt_sdca_jack_common component. The issue occurs when different codecs use the same DAI (Digital Audio Interface) name, causing sof_sdw_rt_sdca_jack_exit() to be called twice by mc_dailink_exit_loop() (NVD, Red Hat).

The vulnerability stems from a double device release issue in the Intel sound driver. When codecs like rt712 and rt713 both use "rt712-sdca-aif1" as their DAI name, the sof_sdw_rt_sdca_jack_exit() function is called multiple times, potentially leading to a double free of ctx->headset_codec_dev. The issue has been assigned a CVSS v3 base score of 5.5 (Low Impact) by Red Hat, with an attack vector of Local, low attack complexity, and low privileges required (Red Hat).

The vulnerability can result in a potential system crash due to the double release of a device resource. The impact is primarily limited to availability, with no direct effects on confidentiality or integrity. Red Hat's assessment indicates high availability impact but no confidentiality or integrity impact (Red Hat).

The vulnerability requires local access with low privileges to exploit. The attack complexity is rated as low, indicating that the vulnerability is relatively straightforward to exploit if an attacker has the necessary local access (Red Hat).

A fix has been implemented by setting ctx->headset_codec_dev = NULL after put_device(ctx->headset_codec_dev) to prevent the double release issue. This patch has been merged into the Linux kernel codebase (Kernel Commit).