CVE-2022-49733

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2022-49733
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant.

4.7 /10

CVSS v3 : MEDIUM

V3 Legend

Vector :

Exploitability : 1.0 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity HIGH

Privileges Required LOW

User Interaction NONE

Confidentiality Impact NONE

Integrity Impact NONE

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0 Patch
https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb Patch
https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 Patch
https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d Patch
https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36 Patch
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*
History

01 Oct 2025, 20:17

Type Values Removed Values Added
CWE CWE-476
CWE-362
First Time Linux linux Kernel
Linux
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 4.7
CPE cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
Summary
  • (es) En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: pcm: oss: Corregir ejecución en SNDCTL_DSP_SYNC Hay una pequeña ventana de ejecución en snd_pcm_oss_sync() que se llama desde IOctl SNDCTL_DSP_SYNC PCM de OSS; es decir, la función llama a snd_pcm_oss_make_ready() primero, luego toma el mutex params_lock para el resto. Cuando otro hilo configura nuevamente la secuencia entre ellos, esto genera inconsistencia y puede dar como resultado resultados inesperados como la desreferencia NULL del búfer OSS como un fuzzer detectado recientemente. La solución es simplemente cubrir la llamada a snd_pcm_oss_make_ready() en el mismo mutex params_lock con la variante snd_pcm_oss_make_ready_locked().
References () https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0 - () https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0 - Patch
References () https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb - () https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb - Patch
References () https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 - () https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 - Patch
References () https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d - () https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d - Patch
References () https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36 - () https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36 - Patch

02 Mar 2025, 15:15

Type Values Removed Values Added
New CVE
Information

Published : 2025-03-02 15:15

Updated : 2025-10-01 20:17

NVD link : CVE-2022-49733

Mitre link : CVE-2022-49733

CVE.ORG link : CVE-2022-49733

JSON object : View

Products Affected

linux

  • linux_kernel
CWE
CWE-362

Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CWE-476

NULL Pointer Dereference