CVE-2022-48701
ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface()
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces.
INFO
Published Date :
May 3, 2024, 4:15 p.m.
Last Modified :
March 5, 2025, 3:11 p.m.
Remotely Exploit :
No
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
CVSS Scores
| Score | Version | Severity | Vector | Exploitability Score | Impact Score | Source |
|---|---|---|---|---|---|---|
| CVSS 3.1 | HIGH | [email protected] |
Solution
- Update the affected Linux packages.
- Reboot the system if required.
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-48701.
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-48701 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-48701
weaknesses.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-48701 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-48701 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Mar. 05, 2025
Action Type Old Value New Value Added CVSS V3.1 AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:H Added CWE CWE-125 Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 from (excluding) 4.14.293 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 from (excluding) 4.19.258 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (excluding) 4.9.328 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 from (excluding) 5.4.213 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 from (excluding) 5.10.143 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 from (excluding) 5.15.68 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 from (excluding) 5.19.9 Added Reference Type CVE: https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061 Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061 Types: Patch Added Reference Type CVE: https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf Types: Patch Added Reference Type kernel.org: https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf Types: Patch -
CVE Modified by af854a3a-2127-422b-91ae-364da2661108
Nov. 21, 2024
Action Type Old Value New Value Added Reference https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712 Added Reference https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936 Added Reference https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf Added Reference https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0 Added Reference https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251 Added Reference https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd Added Reference https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061 Added Reference https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 28, 2024
Action Type Old Value New Value -
CVE Modified by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 14, 2024
Action Type Old Value New Value -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
May. 03, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() There may be a bad USB audio device with a USB ID of (0x04fa, 0x4201) and the number of it's interfaces less than 4, an out-of-bounds read bug occurs when parsing the interface descriptor for this device. Fix this by checking the number of interfaces. Added Reference kernel.org https://git.kernel.org/stable/c/b970518014f2f0f6c493fb86c1e092b936899061 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/91904870370fd986c29719846ed76d559de43251 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2a308e415d247a23d4d64c964c02e782eede2936 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/0492798bf8dfcc09c9337a1ba065da1d1ca68712 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/6123bec8480d23369e2ee0b2208611619f269faf [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/98e8e67395cc6d0cdf3a771f86ea42d0ee6e59dd [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/8293e61bbf908b18ff9935238d4fc2ad359e3fe0 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e53f47f6c1a56d2af728909f1cb894da6b43d9bf [No types assigned]