Detections
Analytics

Echo: linux: security update to 6.7.12-1

medium Tenable Cloud Security Plugin ID 462850

Description

There are packages installed that are affected by a vulnerability referenced in the following CVE:

 - In the Linux kernel, the following vulnerability has been resolved: ASoC: SOF: ipc4-pcm: Workaround for
 crashed firmware on system suspend When the system is suspended while audio is active, the
 sof_ipc4_pcm_hw_free() is invoked to reset the pipelines since during suspend the DSP is turned off,
 streams will be re-started after resume. If the firmware crashes during while audio is running (or when we
 reset the stream before suspend) then the sof_ipc4_set_multi_pipeline_state() will fail with IPC error and
 the state change is interrupted. This will cause misalignment between the kernel and firmware state on
 next DSP boot resulting errors returned by firmware for IPC messages, eventually failing the audio resume.
 On stream close the errors are ignored so the kernel state will be corrected on the next DSP boot, so the
 second boot after the DSP panic. If sof_ipc4_trigger_pipelines() is called from sof_ipc4_pcm_hw_free()
 then state parameter is SOF_IPC4_PIPE_RESET and only in this case. Treat a forced pipeline reset similarly
 to how we treat a pcm_free by ignoring error on state sending to allow the kernel's state to be consistent
 with the state the firmware will have after the next boot. (CVE-2024-27057)

Solution

Update the linux library and its related packages to version 6.7.12-1 or later.

See Also

https://advisory.echohq.com/cve/CVE-2024-27057

Plugin Details

Severity: Medium

ID: 462850

Version: Revision 1.1

Type: Local

Published: 10/2/2026

Updated: 10/2/2026

Risk Information

VPR

Risk Factor: Low

Score: 3

Percentile: 23.18

CVSS v2

Risk Factor: Medium

Base Score: 4.6

Temporal Score: 3.4

Vector: CVSS2#AV:L/AC:L/Au:S/C:N/I:N/A:C

CVSS Score Source: CVE-2024-27057

CVSS v3

Risk Factor: Medium

Base Score: 5.5

Temporal Score: 4.8

Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C

Vulnerability Information

Exploit Ease: No known exploits are available

Patch Publication Date: 9/15/2025

Vulnerability Publication Date: 5/1/2024

Reference Information

CVE: CVE-2024-27057