CVE-2022-49733 (GCVE-0-2022-49733)

Vulnerability from cvelistv5 – Published: 2025-03-02 14:30 – Updated: 2026-08-05 08:56
VLAI
Title
ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently. The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant.
Severity
7.8 (High)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.7 (Medium)
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
SSVC
Exploitation: none Automatable: no Technical Impact: partial
CISA Coordinator (v2.0.3)
CWE
  • CWE-476 - NULL Pointer Dereference
Assigner
References
Impacted products
Vendor Product Version
Linux Linux Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 4051324a6dafd7053c74c475e80b3ba10ae672b0 (git)
Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < fce793a056c604b41a298317cf704dae255f1b36 (git)
Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 8015ef9e8a0ee5cecfd0cb6805834d007ab26f86 (git)
Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 723ac5ab2891b6c10dd6cc78ef5456af593490eb (git)
Affected: e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43 , < 8423f0b6d513b259fdab9c9bf4aaa6188d054c2d (git)
Create a notification for this product.
Linux Linux Affected: 2.6.20
Unaffected: 0 , < 2.6.20 (semver)
Unaffected: 5.4.215 , ≤ 5.4.* (semver)
Unaffected: 5.10.148 , ≤ 5.10.* (semver)
Unaffected: 5.15.68 , ≤ 5.15.* (semver)
Unaffected: 5.19.9 , ≤ 5.19.* (semver)
Unaffected: 6.0 , ≤ * (original_commit_for_fix)
Create a notification for this product.
Show details on NVD website
To clipboard 

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "cvssV3_1": {
              "attackComplexity": "HIGH",
              "attackVector": "LOCAL",
              "availabilityImpact": "HIGH",
              "baseScore": 4.7,
              "baseSeverity": "MEDIUM",
              "confidentialityImpact": "NONE",
              "integrityImpact": "NONE",
              "privilegesRequired": "LOW",
              "scope": "UNCHANGED",
              "userInteraction": "NONE",
              "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H",
              "version": "3.1"
            }
          },
          {
            "other": {
              "content": {
                "id": "CVE-2022-49733",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-10-01T19:28:32.574856Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-476",
                "description": "CWE-476 NULL Pointer Dereference",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-01T19:36:38.398Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/pcm_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "4051324a6dafd7053c74c475e80b3ba10ae672b0",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "fce793a056c604b41a298317cf704dae255f1b36",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "8015ef9e8a0ee5cecfd0cb6805834d007ab26f86",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "723ac5ab2891b6c10dd6cc78ef5456af593490eb",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            },
            {
              "lessThan": "8423f0b6d513b259fdab9c9bf4aaa6188d054c2d",
              "status": "affected",
              "version": "e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/core/oss/pcm_oss.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "2.6.20"
            },
            {
              "lessThan": "2.6.20",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.215",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.148",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.68",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.19.*",
              "status": "unaffected",
              "version": "5.19.9",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "6.0",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.215",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.148",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.68",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.19.9",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0",
                  "versionStartIncluding": "2.6.20",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\n\nThere is a small race window at snd_pcm_oss_sync() that is called from\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\nfor the rest.  When the stream is set up again by another thread\nbetween them, it leads to inconsistency, and may result in unexpected\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\nrecently.\n\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "scenarios": [
            {
              "lang": "en",
              "value": "AV:L - Triggered via local SNDCTL_DSP_SYNC ioctl on OSS PCM devices (/dev/dsp), requiring local process access to the sound device node rather than network or physical reachability.\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same OSS fd (e.g., SNDCTL_DSP_SYNC racing SNDCTL_DSP_SPEED, which sets params then calls change_params via get_active_substream without checking rw_ref).\nPR:L - Opening /dev/dsp and issuing OSS ioctls requires only ordinary local user access (typically audio-group membership); the code path has no capability checks or root requirement.\nUI:N - Exploitation needs no victim action; the attacker opens the device and issues the racing ioctls themselves.\nS:U - Impact is confined to the host kernel authority (crash or memory corruption in-process); there is no VM/IOMMU/sandbox boundary crossing.\nC:H - The race leaves period_ptr inconsistent with a reallocated or NULL OSS buffer, enabling size_t underflow and out-of-bounds writes via snd_pcm_format_set_silence that can corrupt kernel heap and be leveraged for information disclosure.\nI:H - The same inconsistent state yields an out-of-bounds write into kernel memory (or NULL dereference after failed reallocation), which is exploitable for integrity compromise and control-flow hijacking.\nA:H - The documented NULL dereference of the OSS buffer causes a kernel oops/panic, and the OOB write path similarly crashes or hangs the kernel."
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-05T08:56:09.069Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0"
        },
        {
          "url": "https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36"
        },
        {
          "url": "https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86"
        },
        {
          "url": "https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb"
        },
        {
          "url": "https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d"
        }
      ],
      "title": "ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49733",
    "datePublished": "2025-03-02T14:30:02.838Z",
    "dateReserved": "2025-02-26T02:21:30.449Z",
    "dateUpdated": "2026-08-05T08:56:09.069Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2022-49733",
      "date": "2026-08-06",
      "epss": "0.00153",
      "percentile": "0.04983"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2022-49733\",\"sourceIdentifier\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"published\":\"2025-03-02T15:15:11.480\",\"lastModified\":\"2026-08-04T10:17:54.840\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\\n\\nThere is a small race window at snd_pcm_oss_sync() that is called from\\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\\nfor the rest.  When the stream is set up again by another thread\\nbetween them, it leads to inconsistency, and may result in unexpected\\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\\nrecently.\\n\\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.\"},{\"lang\":\"es\",\"value\":\"En el kernel de Linux, se ha resuelto la siguiente vulnerabilidad: ALSA: pcm: oss: Corregir ejecuci\u00f3n en SNDCTL_DSP_SYNC Hay una peque\u00f1a ventana de ejecuci\u00f3n en snd_pcm_oss_sync() que se llama desde IOctl SNDCTL_DSP_SYNC PCM de OSS; es decir, la funci\u00f3n llama a snd_pcm_oss_make_ready() primero, luego toma el mutex params_lock para el resto. Cuando otro hilo configura nuevamente la secuencia entre ellos, esto genera inconsistencia y puede dar como resultado resultados inesperados como la desreferencia NULL del b\u00fafer OSS como un fuzzer detectado recientemente. La soluci\u00f3n es simplemente cubrir la llamada a snd_pcm_oss_make_ready() en el mismo mutex params_lock con la variante snd_pcm_oss_make_ready_locked().\"}],\"affected\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"affectedData\":[{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"unaffected\",\"programFiles\":[\"sound/core/oss/pcm_oss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\",\"lessThan\":\"4051324a6dafd7053c74c475e80b3ba10ae672b0\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\",\"lessThan\":\"fce793a056c604b41a298317cf704dae255f1b36\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\",\"lessThan\":\"8015ef9e8a0ee5cecfd0cb6805834d007ab26f86\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\",\"lessThan\":\"723ac5ab2891b6c10dd6cc78ef5456af593490eb\",\"versionType\":\"git\",\"status\":\"affected\"},{\"version\":\"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\",\"lessThan\":\"8423f0b6d513b259fdab9c9bf4aaa6188d054c2d\",\"versionType\":\"git\",\"status\":\"affected\"}]},{\"vendor\":\"Linux\",\"product\":\"Linux\",\"defaultStatus\":\"affected\",\"programFiles\":[\"sound/core/oss/pcm_oss.c\"],\"repo\":\"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\",\"versions\":[{\"version\":\"2.6.20\",\"status\":\"affected\"},{\"version\":\"0\",\"lessThan\":\"2.6.20\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.4.215\",\"lessThanOrEqual\":\"5.4.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.10.148\",\"lessThanOrEqual\":\"5.10.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.15.68\",\"lessThanOrEqual\":\"5.15.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"5.19.9\",\"lessThanOrEqual\":\"5.19.*\",\"versionType\":\"semver\",\"status\":\"unaffected\"},{\"version\":\"6.0\",\"lessThanOrEqual\":\"*\",\"versionType\":\"original_commit_for_fix\",\"status\":\"unaffected\"}]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\",\"baseScore\":7.8,\"baseSeverity\":\"HIGH\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.8,\"impactScore\":5.9},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":4.7,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"HIGH\",\"privilegesRequired\":\"LOW\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":1.0,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2025-10-01T19:28:32.574856Z\",\"id\":\"CVE-2022-49733\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-362\"},{\"lang\":\"en\",\"value\":\"CWE-476\"}]},{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-476\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"5.4.215\",\"matchCriteriaId\":\"C1F13D37-AD51-4E30-9FD7-F6B539CE6CED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.5\",\"versionEndExcluding\":\"5.10.148\",\"matchCriteriaId\":\"A125CF4C-603D-4ED4-AE18-CFC7C8D5CCF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.11\",\"versionEndExcluding\":\"5.15.68\",\"matchCriteriaId\":\"C440CED2-FE3C-495D-839C-857FFC6F523A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"5.16\",\"versionEndExcluding\":\"5.19.9\",\"matchCriteriaId\":\"B4895A99-6E1B-4C76-A510-FDED00AD7D29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E8BD11A3-8643-49B6-BADE-5029A0117325\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AD220-F6A9-4012-8636-155F1B841FAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"A46498B3-78E1-4623-AAE1-94D29A42BE4E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F8446E87-F5F6-41CA-8201-BAE0F0CA6DD9\"}]}]}],\"references\":[{\"url\":\"https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]},{\"url\":\"https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36\",\"source\":\"416baaa9-dc9f-4396-8d5f-8c081fb06d67\",\"tags\":[\"Patch\"]}]}}",
    "redhat_vex": {
      "aggregate_severity": "Low",
      "current_release_date": "2026-06-30T10:38:35+00:00",
      "cve": "CVE-2022-49733",
      "id": "CVE-2022-49733",
      "initial_release_date": "2022-01-01T00:00:00+00:00",
      "product_status:known_affected": "14",
      "product_status:known_not_affected": "260",
      "source": "Red Hat CSAF VEX",
      "status": "final",
      "title": "kernel: ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC",
      "url": "https://security.access.redhat.com/data/csaf/v2/vex/2022/cve-2022-49733.json",
      "version": "3"
    },
    "suse_vex": {
      "aggregate_severity": "moderate",
      "current_release_date": "2026-08-05T01:12:56Z",
      "cve": "CVE-2022-49733",
      "id": "CVE-2022-49733",
      "initial_release_date": "2025-03-05T02:33:11Z",
      "product_status:known_not_affected": "236",
      "product_status:recommended": "300",
      "source": "SUSE CSAF VEX",
      "status": "interim",
      "title": "SUSE CVE CVE-2022-49733",
      "url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2022-49733.json",
      "version": "47"
    },
    "vulnrichment": {
      "containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 4.7, \"attackVector\": \"LOCAL\", \"baseSeverity\": \"MEDIUM\", \"vectorString\": \"CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"HIGH\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"LOW\", \"confidentialityImpact\": \"NONE\"}}, {\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2022-49733\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2025-10-01T19:28:32.574856Z\"}}}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-476\", \"description\": \"CWE-476 NULL Pointer Dereference\"}]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2025-10-01T16:56:57.587Z\"}}], \"cna\": {\"title\": \"ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\", \"metrics\": [{\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 7.8, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H\"}, \"scenarios\": [{\"lang\": \"en\", \"value\": \"AV:L - Triggered via local SNDCTL_DSP_SYNC ioctl on OSS PCM devices (/dev/dsp), requiring local process access to the sound device node rather than network or physical reachability.\\nAC:L - The attacker controls both sides of the race by running concurrent threads on the same OSS fd (e.g., SNDCTL_DSP_SYNC racing SNDCTL_DSP_SPEED, which sets params then calls change_params via get_active_substream without checking rw_ref).\\nPR:L - Opening /dev/dsp and issuing OSS ioctls requires only ordinary local user access (typically audio-group membership); the code path has no capability checks or root requirement.\\nUI:N - Exploitation needs no victim action; the attacker opens the device and issues the racing ioctls themselves.\\nS:U - Impact is confined to the host kernel authority (crash or memory corruption in-process); there is no VM/IOMMU/sandbox boundary crossing.\\nC:H - The race leaves period_ptr inconsistent with a reallocated or NULL OSS buffer, enabling size_t underflow and out-of-bounds writes via snd_pcm_format_set_silence that can corrupt kernel heap and be leveraged for information disclosure.\\nI:H - The same inconsistent state yields an out-of-bounds write into kernel memory (or NULL dereference after failed reallocation), which is exploitable for integrity compromise and control-flow hijacking.\\nA:H - The documented NULL dereference of the OSS buffer causes a kernel oops/panic, and the OOB write path similarly crashes or hangs the kernel.\"}]}], \"affected\": [{\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\", \"lessThan\": \"4051324a6dafd7053c74c475e80b3ba10ae672b0\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\", \"lessThan\": \"fce793a056c604b41a298317cf704dae255f1b36\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\", \"lessThan\": \"8015ef9e8a0ee5cecfd0cb6805834d007ab26f86\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\", \"lessThan\": \"723ac5ab2891b6c10dd6cc78ef5456af593490eb\", \"versionType\": \"git\"}, {\"status\": \"affected\", \"version\": \"e3a5d59a17e9a42e3f3e0e37342b2679bab2ff43\", \"lessThan\": \"8423f0b6d513b259fdab9c9bf4aaa6188d054c2d\", \"versionType\": \"git\"}], \"programFiles\": [\"sound/core/oss/pcm_oss.c\"], \"defaultStatus\": \"unaffected\"}, {\"repo\": \"https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git\", \"vendor\": \"Linux\", \"product\": \"Linux\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.6.20\"}, {\"status\": \"unaffected\", \"version\": \"0\", \"lessThan\": \"2.6.20\", \"versionType\": \"semver\"}, {\"status\": \"unaffected\", \"version\": \"5.4.215\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.4.*\"}, {\"status\": \"unaffected\", \"version\": \"5.10.148\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.10.*\"}, {\"status\": \"unaffected\", \"version\": \"5.15.68\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.15.*\"}, {\"status\": \"unaffected\", \"version\": \"5.19.9\", \"versionType\": \"semver\", \"lessThanOrEqual\": \"5.19.*\"}, {\"status\": \"unaffected\", \"version\": \"6.0\", \"versionType\": \"original_commit_for_fix\", \"lessThanOrEqual\": \"*\"}], \"programFiles\": [\"sound/core/oss/pcm_oss.c\"], \"defaultStatus\": \"affected\"}], \"references\": [{\"url\": \"https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0\"}, {\"url\": \"https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36\"}, {\"url\": \"https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86\"}, {\"url\": \"https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490eb\"}, {\"url\": \"https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2d\"}], \"x_generator\": {\"engine\": \"bippy-1.2.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"In the Linux kernel, the following vulnerability has been resolved:\\n\\nALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC\\n\\nThere is a small race window at snd_pcm_oss_sync() that is called from\\nOSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls\\nsnd_pcm_oss_make_ready() at first, then takes the params_lock mutex\\nfor the rest.  When the stream is set up again by another thread\\nbetween them, it leads to inconsistency, and may result in unexpected\\nresults such as NULL dereference of OSS buffer as a fuzzer spotted\\nrecently.\\n\\nThe fix is simply to cover snd_pcm_oss_make_ready() call into the same\\nparams_lock mutex with snd_pcm_oss_make_ready_locked() variant.\"}], \"cpeApplicability\": [{\"nodes\": [{\"negate\": false, \"cpeMatch\": [{\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.4.215\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.10.148\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.15.68\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"5.19.9\", \"versionStartIncluding\": \"2.6.20\"}, {\"criteria\": \"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*\", \"vulnerable\": true, \"versionEndExcluding\": \"6.0\", \"versionStartIncluding\": \"2.6.20\"}], \"operator\": \"OR\"}]}], \"providerMetadata\": {\"orgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"shortName\": \"Linux\", \"dateUpdated\": \"2026-08-05T08:56:09.069Z\"}}}",
      "cveMetadata": "{\"cveId\": \"CVE-2022-49733\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-05T08:56:09.069Z\", \"dateReserved\": \"2025-02-26T02:21:30.449Z\", \"assignerOrgId\": \"416baaa9-dc9f-4396-8d5f-8c081fb06d67\", \"datePublished\": \"2025-03-02T14:30:02.838Z\", \"assignerShortName\": \"Linux\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.


Detection rules are retrieved from Rulezet.