Log in Start free

Vulnerability · Published Feb 26, 2025 · Assigned by Linux

CVE-2022-49288ALSA: pcm: Fix races among concurrent prealloc proc writes

High 7.8

In plain English

A high-severity use-after-free in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.3% (higher than 21% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)0.3%top 79.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent prealloc proc writes We have no protection against concurrent PCM buffer preallocation changes via proc files, and it may potentially lead to UAF or some weird problem. This patch applies the PCM open_mutex to the proc write operation for avoiding the racy proc writes and the PCM stream open (and further operations).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux5.17.3-1DEBIAN-CVE-2022-49288
Debian:13linux5.17.3-1DEBIAN-CVE-2022-49288
Debian:14linux5.17.3-1DEBIAN-CVE-2022-49288
Ubuntu:22.04:LTSlinux5.15.0-37.39UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-aws5.15.0-1011.14UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure5.15.0-1010.12UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-gcp5.15.0-1008.12UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-gke5.15.0-1008.10UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-ibm5.15.0-1007.8UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-intel-iot-realtimeno fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1008.11UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-kvm5.15.0-1010.11UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-37.39UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oracle5.15.0-1009.12UBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-raspi5.15.0-1011.13UBUNTU-CVE-2022-49288
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-49288
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-49288

Affected products (as reported)

VendorProductVersions
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before e7786c445bb67a9a6e64f66ebd6b7215b153ff7d1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before e14dca613e0a6ddc2bf6e360f16936a9f865205b1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 37b12c16beb6f6c1c3c678c1aacbc46525c250f71da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before b560d670c87d7d40b3cf6949246fa4c7aa65a00a1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 51fce708ab8986a9879ee5da946a2cc120f1036d1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before a21d2f323b5a978dedf9ff1d50f101f85e39b3f21da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 5ed8f8e3c4e59d0396b9ccf2e639711e24295bb61da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 69534c48ba8ce552ce383b3dfdb271ffe51820c3
Linux Linux 2.6.12

Weakness: CWE-416 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References