FKIE_CVE-2022-50773

Vulnerability from fkie_nvd - Published: 2025-12-24 13:16 - Updated: 2025-12-24 13:16
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt I got a null-ptr-defer error report when I do the following tests on the qemu platform: make defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m, CONFIG_SND_MTS64=m Then making test scripts: cat>test_mod1.sh<<EOF modprobe snd-mts64 modprobe snd-mts64 EOF Executing the script, perhaps several times, we will get a null-ptr-defer report, as follow: syzkaller:~# ./test_mod.sh snd_mts64: probe of snd_mts64.0 failed with error -5 modprobe: ERROR: could not insert 'snd_mts64': No such device BUG: kernel NULL pointer dereference, address: 0000000000000000 #PF: supervisor write access in kernel mode #PF: error_code(0x0002) - not-present page PGD 0 P4D 0 Oops: 0002 [#1] PREEMPT SMP PTI CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6 Call Trace: <IRQ> snd_mts64_interrupt+0x24/0xa0 [snd_mts64] parport_irq_handler+0x37/0x50 [parport] __handle_irq_event_percpu+0x39/0x190 handle_irq_event_percpu+0xa/0x30 handle_irq_event+0x2f/0x50 handle_edge_irq+0x99/0x1b0 __common_interrupt+0x5d/0x100 common_interrupt+0xa0/0xc0 </IRQ> <TASK> asm_common_interrupt+0x22/0x40 RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30 parport_claim+0xbd/0x230 [parport] snd_mts64_probe+0x14a/0x465 [snd_mts64] platform_probe+0x3f/0xa0 really_probe+0x129/0x2c0 __driver_probe_device+0x6d/0xc0 driver_probe_device+0x1a/0xa0 __device_attach_driver+0x7a/0xb0 bus_for_each_drv+0x62/0xb0 __device_attach+0xe4/0x180 bus_probe_device+0x82/0xa0 device_add+0x550/0x920 platform_device_add+0x106/0x220 snd_mts64_attach+0x2e/0x80 [snd_mts64] port_check+0x14/0x20 [parport] bus_for_each_dev+0x6e/0xc0 __parport_register_driver+0x7c/0xb0 [parport] snd_mts64_module_init+0x31/0x1000 [snd_mts64] do_one_initcall+0x3c/0x1f0 do_init_module+0x46/0x1c6 load_module+0x1d8d/0x1e10 __do_sys_finit_module+0xa2/0xf0 do_syscall_64+0x37/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd </TASK> Kernel panic - not syncing: Fatal exception in interrupt Rebooting in 1 seconds.. The mts wa not initialized during interrupt, we add check for mts to fix this bug.
References
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/0649129359219ce6ff380ec401f87308485c6ae3
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/06ec592389f2be3199779ab823c4323dcfd2121f
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/1a763c748acd5540ccc43306c57c9c6c5fb60884
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/250eed7b9994d79f9c409f954dbd08e88f5afd83
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/7e91667db38abb056da5a496d40fbd044c66bed2
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/b471fe61da523a15e4cb60fa81f5a2377e4bad98
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/c7e9624d90bf20f1eed6b228949396d614b94020
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cba633b24a98d957e8190ef8bc4d4cdb4f6e9313
416baaa9-dc9f-4396-8d5f-8c081fb06d67https://git.kernel.org/stable/c/cf2ea3c86ad90d63d1c572b43e1ca9276b0357ad
Impacted products
Vendor Product Version
To clipboard 

{
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: mts64: fix possible null-ptr-defer in snd_mts64_interrupt\n\nI got a null-ptr-defer error report when I do the following tests\non the qemu platform:\n\nmake defconfig and CONFIG_PARPORT=m, CONFIG_PARPORT_PC=m,\nCONFIG_SND_MTS64=m\n\nThen making test scripts:\ncat\u003etest_mod1.sh\u003c\u003cEOF\nmodprobe snd-mts64\nmodprobe snd-mts64\nEOF\n\nExecuting the script, perhaps several times, we will get a null-ptr-defer\nreport, as follow:\n\nsyzkaller:~# ./test_mod.sh\nsnd_mts64: probe of snd_mts64.0 failed with error -5\nmodprobe: ERROR: could not insert \u0027snd_mts64\u0027: No such device\n BUG: kernel NULL pointer dereference, address: 0000000000000000\n #PF: supervisor write access in kernel mode\n #PF: error_code(0x0002) - not-present page\n PGD 0 P4D 0\n Oops: 0002 [#1] PREEMPT SMP PTI\n CPU: 0 PID: 205 Comm: modprobe Not tainted 6.1.0-rc8-00588-g76dcd734eca2 #6\n Call Trace:\n  \u003cIRQ\u003e\n  snd_mts64_interrupt+0x24/0xa0 [snd_mts64]\n  parport_irq_handler+0x37/0x50 [parport]\n  __handle_irq_event_percpu+0x39/0x190\n  handle_irq_event_percpu+0xa/0x30\n  handle_irq_event+0x2f/0x50\n  handle_edge_irq+0x99/0x1b0\n  __common_interrupt+0x5d/0x100\n  common_interrupt+0xa0/0xc0\n  \u003c/IRQ\u003e\n  \u003cTASK\u003e\n  asm_common_interrupt+0x22/0x40\n RIP: 0010:_raw_write_unlock_irqrestore+0x11/0x30\n  parport_claim+0xbd/0x230 [parport]\n  snd_mts64_probe+0x14a/0x465 [snd_mts64]\n  platform_probe+0x3f/0xa0\n  really_probe+0x129/0x2c0\n  __driver_probe_device+0x6d/0xc0\n  driver_probe_device+0x1a/0xa0\n  __device_attach_driver+0x7a/0xb0\n  bus_for_each_drv+0x62/0xb0\n  __device_attach+0xe4/0x180\n  bus_probe_device+0x82/0xa0\n  device_add+0x550/0x920\n  platform_device_add+0x106/0x220\n  snd_mts64_attach+0x2e/0x80 [snd_mts64]\n  port_check+0x14/0x20 [parport]\n  bus_for_each_dev+0x6e/0xc0\n  __parport_register_driver+0x7c/0xb0 [parport]\n  snd_mts64_module_init+0x31/0x1000 [snd_mts64]\n  do_one_initcall+0x3c/0x1f0\n  do_init_module+0x46/0x1c6\n  load_module+0x1d8d/0x1e10\n  __do_sys_finit_module+0xa2/0xf0\n  do_syscall_64+0x37/0x90\n  entry_SYSCALL_64_after_hwframe+0x63/0xcd\n  \u003c/TASK\u003e\n Kernel panic - not syncing: Fatal exception in interrupt\n Rebooting in 1 seconds..\n\nThe mts wa not initialized during interrupt,  we add check for\nmts to fix this bug."
    }
  ],
  "id": "CVE-2022-50773",
  "lastModified": "2025-12-24T13:16:04.120",
  "metrics": {},
  "published": "2025-12-24T13:16:04.120",
  "references": [
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/0649129359219ce6ff380ec401f87308485c6ae3"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/06ec592389f2be3199779ab823c4323dcfd2121f"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/1a763c748acd5540ccc43306c57c9c6c5fb60884"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/250eed7b9994d79f9c409f954dbd08e88f5afd83"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/7e91667db38abb056da5a496d40fbd044c66bed2"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/b471fe61da523a15e4cb60fa81f5a2377e4bad98"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/c7e9624d90bf20f1eed6b228949396d614b94020"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cba633b24a98d957e8190ef8bc4d4cdb4f6e9313"
    },
    {
      "source": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
      "url": "https://git.kernel.org/stable/c/cf2ea3c86ad90d63d1c572b43e1ca9276b0357ad"
    }
  ],
  "sourceIdentifier": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
  "vulnStatus": "Received"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.