Log in Start free

Vulnerability · Published Oct 21, 2024 · Assigned by Linux

CVE-2022-48994ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event

Medium 5.5

In plain English

A medium-severity security flaw in Linux from Linux. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.2% (higher than 15% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS NVD)5.5Medium
Exploit odds (30 days)0.2%top 85.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux6.1.4-1DEBIAN-CVE-2022-48994
Debian:13linux6.1.4-1DEBIAN-CVE-2022-48994
Debian:14linux6.1.4-1DEBIAN-CVE-2022-48994
Ubuntu:22.04:LTSlinux5.15.0-67.74UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-allwinner-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-aws5.15.0-1031.35UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-aws-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-aws-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-aws-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure5.15.0-1034.41UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-fde5.15.0-1034.41.1UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-fde-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-azure-fde-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gcp5.15.0-1030.37UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gcp-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gcp-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gcp-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gke5.15.0-1028.33UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-gkeop5.15.0-1016.21UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-hwe-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-hwe-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-hwe-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-ibm5.15.0-1026.29UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-intel-iotg5.15.0-1026.31UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-kvm5.15.0-1029.34UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-lowlatency5.15.0-67.74UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-lowlatency-hwe-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-lowlatency-hwe-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-nvidia5.15.0-1023.23UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-nvidia-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-nvidia-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oem-5.17no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oem-6.0no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oem-6.1no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oem-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oracle5.15.0-1030.36UBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-oracle-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-raspi5.15.0-1025.27UBUNTU-CVE-2022-48994
Ubuntu:24.04:LTSlinux-raspi-realtimeno fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-realtimeno fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-riscvno fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-riscv-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-riscv-6.5no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-starfive-5.19no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-starfive-6.2no fix listedUBUNTU-CVE-2022-48994
Ubuntu:22.04:LTSlinux-starfive-6.5no fix listedUBUNTU-CVE-2022-48994

Affected products (as reported)

VendorProductVersions
Linux Linux 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before b38486e82ecb9f3046e0184205f6b61408fc40c91da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before e385360705a0b346bdb57ce938249175d0613b8a1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 2f46e95bf344abc4e74f8158901d32a869e0adb61da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 63badfed200219ca656968725f1a43df293ac9361da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 15c42ab8d43acb73e2eba361ad05822c0af0ecfa1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before fccd454129f6a0739651f7f58307cdb631fd6e891da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 13ee8fb5410b740c8dd2867d3557c7662f7dda2d1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 – before 05530ef7cf7c7d700f6753f058999b1b5099a026
Linux Linux 2.6.12

References