CVE-2022-1048: A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params

High severity · published Apr 29, 2022

CVE-2022-1048

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params

7.0

CVSS

0.2%

EPSS

On KEV

Description

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Attack vector

Local

Complexity

High

Privileges

Low

User interaction

None

Confidentiality

High

Integrity

High

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.2% · higher than 15% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Kernel · Linux

2.6.12 before 4.14.279; 4.15 before 4.19.243; 4.20 before 5.4.193; 5.5 before 5.10.109; 5.11 before 5.15.32; 5.16 before 5.16.18; +1 more · source: NVD

Debian Linux · Debian

10.0; 11.0 · source: NVD

Enterprise Linux · Redhat

8.0 · source: NVD

H300e Firmware · Netapp

All versions, or not specified · source: NVD

H300s Firmware · Netapp

All versions, or not specified · source: NVD

H410c Firmware · Netapp

All versions, or not specified · source: NVD

H410s Firmware · Netapp

All versions, or not specified · source: NVD