CVE-2022-1048

Katalog CVE

CVSS 7.0 · High EPSS 0,24%

Kerentanan Use After Free pada linux kernel, redhat enterprise linux +9 lainnya. Skor CVSS 3.1 7.0 (High) menurut NVD.

Deskripsi (NVD)

A use-after-free flaw was found in the Linux kernel’s sound subsystem in the way a user triggers concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the system.

Rincian

Terbit di NVD

29 April 2022

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

7.0 (High), sumber NVD
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-416: Use After Free
CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

EPSS (30 hari)

0,24% peluang dieksploitasi; lebih tinggi dari 14,2% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://lore.kernel.org/lkml/20220322170720.3529-5-tiwai%40suse.de/T/#m1d3b791b815556012c6be92f1c4a7086b854f7f... mailing list · patch
• https://bugzilla.redhat.com/show_bug.cgi?id=2066706 issue tracking · advisory pihak ketiga
• https://security.netapp.com/advisory/ntap-20220629-0001/ advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5127 advisory pihak ketiga
• https://www.debian.org/security/2022/dsa-5173 advisory pihak ketiga