CVE-2022-49292

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49292
In the Linux kernel, the following vulnerability has been resolved: ALSA: oss: Fix PCM OSS buffer allocation overflow We've got syzbot reports hitting INT_MAX overflow at vmalloc() allocation that is called from snd_pcm_plug_alloc(). Although we apply the restrictions to input parameters, it's based only on the hw_params of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INT_MAX, hence it hits WARN_ON(). This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated. In addition, the driver uses array_size() and array3_size() for multiplications to catch overflows for the converted period size and buffer bytes.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b Patch
https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898 Patch
https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b Patch
https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5 Patch
https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a Patch
https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366 Patch
https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:5.17:*:*:*:*:*:*:*
History

22 Sep 2025, 19:44

Type Values Removed Values Added
References () https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b - () https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b - Patch
References () https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898 - () https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898 - Patch
References () https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b - () https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b - Patch
References () https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5 - () https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5 - Patch
References () https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a - () https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a - Patch
References () https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366 - () https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366 - Patch
References () https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade - () https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade - Patch
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 7.8
CPE cpe:2.3:o:linux:linux_kernel:5.17:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
First Time Linux
Linux linux Kernel
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: oss: Fix PCM OSS buffer assignment overflow Tenemos informes de syzbot que alcanzan un desbordamiento de INT_MAX en la asignación de vmalloc() que se llama desde snd_pcm_plug_alloc(). Aunque aplicamos las restricciones a los parámetros de entrada, se basa solo en hw_params del dispositivo PCM subyacente. Dado que la capa PCM OSS asigna un búfer temporal para la conversión de datos, el tamaño puede volverse inesperadamente grande cuando se dan más canales o velocidades más altas; en el caso informado, superó INT_MAX, por lo tanto, alcanza WARN_ON(). Este parche es un intento de evitar dicho desbordamiento y una asignación para búferes demasiado grandes. En primer lugar, agrega el límite de 1 MB como límite superior para bytes de período. Esto debe ser lo suficientemente grande para todos los casos de uso, y realmente no queremos manejar un búfer temporal más grande que este tamaño. La comprobación del tamaño se realiza en dos lugares: donde se calculan los bytes del período original y donde se calcula el tamaño del búfer del complemento. Además, el controlador utiliza array_size() y array3_size() para las multiplicaciones con el fin de detectar desbordamientos en el tamaño del período convertido y los bytes del búfer.
CWE CWE-787

26 Feb 2025, 07:01

Type Values Removed Values Added
New CVE
Information

Published : 2025-02-26 07:01

Updated : 2025-09-22 19:44

NVD link : CVE-2022-49292

Mitre link : CVE-2022-49292

CVE.ORG link : CVE-2022-49292

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-787

Out-of-bounds Write