CVE-2022-3303CWE-362CWE-667

CVE-2022-3303

Medium · published September 28, 2022

CVSS v3.1
4.7
EPSS
0%
Percentile
23.6
In the wild
Unconfirmed
What it is

A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system, resulting in a denial of service condition

The record
Technical detail
CVSS v3.1
4.7 · MEDIUM
Vector
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00318 · 23.6th percentile
Weaknesses
CWE-362 · Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition'); CWE-667 · Improper Locking
Published
2022-09-28T03:15Z
Affected products (7)
ProductVersionsFixed in
linux/linux_kernel< 6.06.0
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
linux/linux_kernelall versions—
debian/debian_linuxall versions—
debian/debian_linuxall versions—
References (9)
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8423f0b6d513b259fdab9c9bf4aaa6188d054c2d · [email protected]https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · [email protected]https://lore.kernel.org/all/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA%40mail.gmail.com/ · [email protected]https://www.debian.org/security/2022/dsa-5257 · [email protected]https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=8423f0b6d513b259fdab9c9bf4aaa6188d054c2d · af854a3a-2127-422b-91ae-364da2661108https://lists.debian.org/debian-lts-announce/2022/11/msg00001.html · af854a3a-2127-422b-91ae-364da2661108https://lore.kernel.org/all/CAFcO6XN7JDM4xSXGhtusQfS2mSBcx50VJKwQpCq=WeLt57aaZA%40mail.gmail.com/ · af854a3a-2127-422b-91ae-364da2661108https://www.debian.org/security/2022/dsa-5257 · af854a3a-2127-422b-91ae-364da2661108https://cert-portal.siemens.com/productcert/html/ssa-794697.html · 0b142b55-0307-4c5a-b3c9-f314f3fb7c5e
EPSS history
Timeline
  • 27 SEP 00:00Z
    A race condition flaw was found in the Linux kernel sound subsystem due to improper locking
    cvelistv5