CVE-2022-1048

Published: 25 March 2022

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

From the Ubuntu security team

Hu Jiahui discovered that multiple race conditions existed in the Advanced Linux Sound Architecture (ALSA) framework, leading to use-after-free vulnerabilities. A local attacker could use these to cause a denial of service (system crash) or possibly execute arbitrary code.

Priority

Medium

CVSS 3 base score: 7.0

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-1048
• https://www.openwall.com/lists/oss-security/2022/03/28/4
• https://ubuntu.com/security/notices/USN-5381-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=2066706