The Linux kernel ALSA asihpi driver contained a vulnerability where the function reading cached control information (find_control()) accessed an array using an unchecked index, leading to a potential out-of-bounds array access. This could result in memory corruption or exposure of sensitive kernel memory. The issue was resolved by introducing a sanity check to validate the index before array access. The vulnerability affects multiple Linux kernel versions prior to the patched releases provided by Ubuntu. The CVSS 3.1 score is 7.8 (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H), indicating a local attacker with low privileges could exploit this to cause high confidentiality, integrity, and availability impacts. The vendor has released patches as part of Ubuntu security notices USN-8575-1 and USN-8576-1, covering various kernel flavors including NVIDIA Tegra. Users must update to the fixed kernel versions and reboot to complete remediation.

Exploitation of this vulnerability could allow a local attacker with low privileges to cause out-of-bounds memory access in kernel space, potentially leading to exposure of sensitive kernel memory, privilege escalation, or system instability. The CVSS score reflects high impact on confidentiality, integrity, and availability. No known exploits in the wild have been reported at this time.

A patch is available from the vendor. Users should update their Linux kernel packages to the fixed versions as provided in the Ubuntu security notices USN-8575-1 and USN-8576-1. After applying the update, a system reboot is required to activate the patched kernel. Due to an ABI change, third-party kernel modules must be recompiled and reinstalled. Follow vendor instructions carefully to ensure complete remediation.