Security Resilience

CVE-2023-52987

Linux Kernel 6.1 – 6.1.11

Published
27 March 2025
Modified
04 August 2026
Patch / advisory
View advisory
CVSS Score v3.1 7.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
EPSS Score 0.0025 15th percentile
Risk Priority 56 floored blend · peak EPSS

CVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.

Summary

CVE-2023-52987 is a high-severity Improper Validation of Array Index (CWE-129) vulnerability in Linux Linux Kernel. Its CVSS base score is 7.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique Steganography (T1001.002); ranked at the 15th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog.

Deeper analysis AI-assisted summary

Synthesised by an AI model from the NVD description and linked references — a reading aid, not an authoritative source.

CVE-2023-52987 is an array underflow vulnerability in the Linux kernel's ASoC SOF ipc4-mtrace component, specifically within the sof_ipc4_priority_mask_dfs_write() function. The issue arises because the "id" parameter, sourced from user input, is treated as a signed integer, enabling an underflow condition. This flaw, classified under CWE-129 (Improper Validation of Array Index), has a CVSS v3.1 base score of 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) and was published on 2025-03-27.

A local attacker with low privileges can exploit this vulnerability due to its low attack complexity and lack of user interaction requirements. Successful exploitation allows high-impact consequences, including unauthorized access to sensitive data (high confidentiality), modification of system resources (high integrity), and denial of service or system disruption (high availability), potentially leading to kernel-level compromise.

Mitigation involves applying the relevant Linux kernel patches, as detailed in the commit references: d52f34784e4e2f6e77671a9f104d8a69a3b5d24c and ea57680af47587397f5005d7758022441ed66d54. These patches resolve the underflow by changing the "id" type to unsigned, preventing the invalid array access. Security practitioners should update affected kernel versions accordingly.

OWASP Top 10 for Web (2025)

A05:2025 Injection

EU & UK References

Vulnerability Data

In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-mtrace: prevent underflow in sof_ipc4_priority_mask_dfs_write() The "id" comes from the user. Change the type to unsigned to prevent an array underflow.

CWE(s)
CWE-129

Related Threats

MITRE ATT&CK Enterprise Techniques

T1001.002 Steganography Command And Control
Adversaries may use steganographic techniques to hide command and control traffic to make detection efforts more difficult.
attack.mitre.org →
T1001.003 Protocol or Service Impersonation Command And Control
Adversaries may impersonate legitimate protocols or web service traffic to disguise command and control activity and thwart analysis efforts.
attack.mitre.org →
T1003.002 Security Account Manager Credential Access
Adversaries may attempt to extract credential material from the Security Account Manager (SAM) database either through in-memory techniques or through the Windows Registry where the SAM database is stored.
attack.mitre.org →
T1003.003 NTDS Credential Access
Adversaries may attempt to access or create a copy of the Active Directory domain database in order to steal credential information, as well as obtain other information about domain members such as devices, users, and access rights.
attack.mitre.org →
T1003.008 /etc/passwd and /etc/shadow Credential Access
Adversaries may attempt to dump the contents of <code>/etc/passwd</code> and <code>/etc/shadow</code> to enable offline password cracking.
attack.mitre.org →
T1008 Fallback Channels Command And Control
Adversaries may use fallback or alternate communication channels if the primary channel is compromised or inaccessible in order to maintain reliable command and control and to avoid data transfer thresholds.
attack.mitre.org →
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2024-26971Same product: Linux Linux Kernel
CVE-2024-43842Same product: Linux Linux Kernel
CVE-2025-21692Same product: Linux Linux Kernel
CVE-2024-42120Same product: Linux Linux Kernel
CVE-2024-26967Same product: Linux Linux Kernel
CVE-2023-52594Same product: Linux Linux Kernel
CVE-2025-21991Same product: Linux Linux Kernel
CVE-2024-46836Same product: Linux Linux Kernel
CVE-2024-41061Same product: Linux Linux Kernel
CVE-2026-46163Same product: Linux Linux Kernel

Affected Assets

linux
linux kernel
6.2 · 6.1 — 6.1.11

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 partial match
blocks

Secure SDLC practices directly require input validation and bounds checking that prevent improper array indexing.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.5.14 Information transfer partial match
removes
A.5.15 Access control partial match
removes
A.5.16 Identity management partial match
removes
A.5.17 Authentication information partial match
removes
A.5.18 Access rights partial match
removes
A.8.10 Information deletion partial match
removes

References