IM
IronMonkey Threat Research

CVE-2022-3303 MEDIUM

Published: 2022-09-27 | Last Modified: 2025-05-21 | Status: Modified

Description

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition

Additional Descriptions (1)

Se ha encontrado un fallo de condición de carrera en el subsistema de sonido del kernel de Linux debido a un bloqueo inapropiado. Podría conllevar a una desreferencia de puntero NULL mientras es manejado el ioctl SNDCTL_DSP_SYNC. Un usuario local privilegiado (root o miembro del grupo de audio) podría usar este fallo para bloquear el sistema, resultando en una situación de denegación de servicio

CVSS Metrics

Base Score: 4.7 (MEDIUM)

CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack VectorLOCAL
Attack ComplexityHIGH
Privileges RequiredLOW
User InteractionNONE
ScopeUNCHANGED
Confidentiality ImpactNONE
Integrity ImpactNONE
Availability ImpactHIGH

Source: [email protected]

Type: Primary

Exploitability Score: 1.0

Impact Score: 3.6

Weaknesses

Source Type Description
[email protected] Secondary
en CWE-667
[email protected] Secondary
en CWE-362
en CWE-667

Affected Products

Vendor Product Version Update Type
linux linux_kernel * <built-in method update of dict object at 0x7fd36a02d580> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd37039b400> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd37039be40> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd37039a200> Operating System
linux linux_kernel 6.0 <built-in method update of dict object at 0x7fd36a02e740> Operating System
debian debian_linux 10.0 <built-in method update of dict object at 0x7fd36a02d680> Operating System
debian debian_linux 11.0 <built-in method update of dict object at 0x7fd369c0e6c0> Operating System

Affected Configurations

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:*
Yes cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:*

Operator: OR

Vulnerable CPE
Yes cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
Yes cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*

References