CVE-2022-48994
ALSA Linux Kernel ROP Attack Prevention Vulnerability
Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.
INFO
Published Date :
Oct. 21, 2024, 8:15 p.m.
Last Modified :
Nov. 7, 2024, 1:52 p.m.
Source :
416baaa9-dc9f-4396-8d5f-8c081fb06d67
Remotely Exploitable :
No
Impact Score :
3.6
Exploitability Score :
1.8
References to Advisories, Solutions, and Tools
Here, you will find a curated list of external links that provide in-depth
information, practical solutions, and valuable tools related to
CVE-2022-48994.
We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).
Results are limited to the first 15 repositories due to potential performance issues.
The following list is the news that have been mention
CVE-2022-48994 vulnerability anywhere in the article.
The following table lists the changes that have been made to the
CVE-2022-48994 vulnerability over time.
Vulnerability history details can be useful for understanding the evolution of a vulnerability, and for identifying the most recent changes that may impact the vulnerability's severity, exploitability, or other characteristics.
-
Initial Analysis by [email protected]
Nov. 07, 2024
Action Type Old Value New Value Added CVSS V3.1 NIST AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H Changed Reference Type https://git.kernel.org/stable/c/05530ef7cf7c7d700f6753f058999b1b5099a026 No Types Assigned https://git.kernel.org/stable/c/05530ef7cf7c7d700f6753f058999b1b5099a026 Patch Changed Reference Type https://git.kernel.org/stable/c/13ee8fb5410b740c8dd2867d3557c7662f7dda2d No Types Assigned https://git.kernel.org/stable/c/13ee8fb5410b740c8dd2867d3557c7662f7dda2d Patch Changed Reference Type https://git.kernel.org/stable/c/15c42ab8d43acb73e2eba361ad05822c0af0ecfa No Types Assigned https://git.kernel.org/stable/c/15c42ab8d43acb73e2eba361ad05822c0af0ecfa Patch Changed Reference Type https://git.kernel.org/stable/c/2f46e95bf344abc4e74f8158901d32a869e0adb6 No Types Assigned https://git.kernel.org/stable/c/2f46e95bf344abc4e74f8158901d32a869e0adb6 Patch Changed Reference Type https://git.kernel.org/stable/c/63badfed200219ca656968725f1a43df293ac936 No Types Assigned https://git.kernel.org/stable/c/63badfed200219ca656968725f1a43df293ac936 Patch Changed Reference Type https://git.kernel.org/stable/c/b38486e82ecb9f3046e0184205f6b61408fc40c9 No Types Assigned https://git.kernel.org/stable/c/b38486e82ecb9f3046e0184205f6b61408fc40c9 Patch Changed Reference Type https://git.kernel.org/stable/c/e385360705a0b346bdb57ce938249175d0613b8a No Types Assigned https://git.kernel.org/stable/c/e385360705a0b346bdb57ce938249175d0613b8a Patch Changed Reference Type https://git.kernel.org/stable/c/fccd454129f6a0739651f7f58307cdb631fd6e89 No Types Assigned https://git.kernel.org/stable/c/fccd454129f6a0739651f7f58307cdb631fd6e89 Patch Added CWE NIST NVD-CWE-noinfo Added CPE Configuration OR *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to (excluding) 4.9.336 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.10 up to (excluding) 4.14.302 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.15 up to (excluding) 4.19.269 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 4.20 up to (excluding) 5.4.227 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.5 up to (excluding) 5.10.159 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.11 up to (excluding) 5.15.83 *cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions from (including) 5.16 up to (excluding) 6.0.13 *cpe:2.3:o:linux:linux_kernel:6.1:rc1:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.1:rc2:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.1:rc3:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.1:rc4:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.1:rc5:*:*:*:*:*:* *cpe:2.3:o:linux:linux_kernel:6.1:rc6:*:*:*:*:*:* -
CVE Received by 416baaa9-dc9f-4396-8d5f-8c081fb06d67
Oct. 21, 2024
Action Type Old Value New Value Added Description In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches. Added Reference kernel.org https://git.kernel.org/stable/c/b38486e82ecb9f3046e0184205f6b61408fc40c9 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/e385360705a0b346bdb57ce938249175d0613b8a [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/2f46e95bf344abc4e74f8158901d32a869e0adb6 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/63badfed200219ca656968725f1a43df293ac936 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/15c42ab8d43acb73e2eba361ad05822c0af0ecfa [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/fccd454129f6a0739651f7f58307cdb631fd6e89 [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/13ee8fb5410b740c8dd2867d3557c7662f7dda2d [No types assigned] Added Reference kernel.org https://git.kernel.org/stable/c/05530ef7cf7c7d700f6753f058999b1b5099a026 [No types assigned]
CWE - Common Weakness Enumeration
While CVE identifies
specific instances of vulnerabilities, CWE categorizes the common flaws or
weaknesses that can lead to vulnerabilities. CVE-2022-48994 is
associated with the following CWEs:
Common Attack Pattern Enumeration and Classification (CAPEC)
Common Attack Pattern Enumeration and Classification
(CAPEC)
stores attack patterns, which are descriptions of the common attributes and
approaches employed by adversaries to exploit the CVE-2022-48994
weaknesses.