CVE-2022-49733

Summary

CVE-2022-49733 is a vulnerability in the Linux kernel's ALSA (Advanced Linux Sound Architecture) component. Specifically, it affects the oss driver in the pcm subsystem. The issue lies in a race condition at snd_pcm_oss_sync(), which is called during the execution of the OSS PCM SNDCTL_DSP_SYNC ioctl. This race window arises from the sequence of function calls: snd_pcm_oss_make_ready() is called first, followed by the acquisition of the params_lock mutex. If another thread sets up the stream between these steps, inconsistency ensues, and the system may encounter unexpected results, such as NULL dereferences of OSS buffers. The vulnerability was discovered through fuzzing. The fix involves modifying snd_pcm_oss_make_ready() to be executed under the params_lock mutex, by replacing it with snd_pcm_oss_make_ready_locked().

Prevent cyber attacks with Recorded Future by prioritizing and patching critical vulnerabilities being exploited by threat actors targeting your industry. Book your demo to learn more.