In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix race at SNDCTLDSPSYNC
There is a small race window at sndpcmosssync() that is called from OSS PCM SNDCTLDSPSYNC ioctl; namely the function calls sndpcmossmakeready() at first, then takes the paramslock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently.
The fix is simply to cover sndpcmossmakeready() call into the same paramslock mutex with sndpcmossmakereadylocked() variant.
[
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8423f0b6d513b259fdab9c9bf4aaa6188d054c2d",
"deprecated": false,
"id": "CVE-2022-49733-14b33322",
"target": {
"function": "snd_pcm_oss_sync",
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"length": 2298.0,
"function_hash": "223597018710323689402456181293977531806"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fce793a056c604b41a298317cf704dae255f1b36",
"deprecated": false,
"id": "CVE-2022-49733-2774f58a",
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"153019307809423740975653519990436266033",
"213387512250178079735390304115892250906",
"146167616383693007832686368311084747169",
"93317985834974600506701342579886303711",
"128077454089028829022146287673226726410",
"51584140627476515304761115604500156521",
"66828793008889379732497239635535560240",
"119016709104423746287155870368458173600",
"204737428784123304028132736892762095887",
"13578157013823600323780596516277411843"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@723ac5ab2891b6c10dd6cc78ef5456af593490eb",
"deprecated": false,
"id": "CVE-2022-49733-3c55f927",
"target": {
"function": "snd_pcm_oss_sync",
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"length": 2298.0,
"function_hash": "223597018710323689402456181293977531806"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@723ac5ab2891b6c10dd6cc78ef5456af593490eb",
"deprecated": false,
"id": "CVE-2022-49733-6296f56e",
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"136364306471635656103482513031655068407",
"331908989757083300008108638572774269151",
"121828637445499887322700666610613543206",
"334695817419663653689419630430543720283",
"151252523157135058326999220974551728079",
"128077454089028829022146287673226726410",
"51584140627476515304761115604500156521",
"66828793008889379732497239635535560240",
"119016709104423746287155870368458173600",
"204737428784123304028132736892762095887",
"13578157013823600323780596516277411843"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@fce793a056c604b41a298317cf704dae255f1b36",
"deprecated": false,
"id": "CVE-2022-49733-6d9daeb7",
"target": {
"function": "snd_pcm_oss_sync",
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"length": 2294.0,
"function_hash": "260673702950548246767687300905763670266"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4051324a6dafd7053c74c475e80b3ba10ae672b0",
"deprecated": false,
"id": "CVE-2022-49733-933f26da",
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"153019307809423740975653519990436266033",
"213387512250178079735390304115892250906",
"146167616383693007832686368311084747169",
"93317985834974600506701342579886303711",
"128077454089028829022146287673226726410",
"51584140627476515304761115604500156521",
"66828793008889379732497239635535560240",
"119016709104423746287155870368458173600",
"204737428784123304028132736892762095887",
"13578157013823600323780596516277411843"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8015ef9e8a0ee5cecfd0cb6805834d007ab26f86",
"deprecated": false,
"id": "CVE-2022-49733-c4e97e5b",
"target": {
"function": "snd_pcm_oss_sync",
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"length": 2298.0,
"function_hash": "223597018710323689402456181293977531806"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@4051324a6dafd7053c74c475e80b3ba10ae672b0",
"deprecated": false,
"id": "CVE-2022-49733-d4def822",
"target": {
"function": "snd_pcm_oss_sync",
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"length": 2294.0,
"function_hash": "260673702950548246767687300905763670266"
},
"signature_type": "Function"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8015ef9e8a0ee5cecfd0cb6805834d007ab26f86",
"deprecated": false,
"id": "CVE-2022-49733-de9cf4b4",
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"136364306471635656103482513031655068407",
"331908989757083300008108638572774269151",
"121828637445499887322700666610613543206",
"334695817419663653689419630430543720283",
"151252523157135058326999220974551728079",
"128077454089028829022146287673226726410",
"51584140627476515304761115604500156521",
"66828793008889379732497239635535560240",
"119016709104423746287155870368458173600",
"204737428784123304028132736892762095887",
"13578157013823600323780596516277411843"
]
},
"signature_type": "Line"
},
{
"signature_version": "v1",
"source": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git@8423f0b6d513b259fdab9c9bf4aaa6188d054c2d",
"deprecated": false,
"id": "CVE-2022-49733-eb74aef6",
"target": {
"file": "sound/core/oss/pcm_oss.c"
},
"digest": {
"threshold": 0.9,
"line_hashes": [
"136364306471635656103482513031655068407",
"331908989757083300008108638572774269151",
"121828637445499887322700666610613543206",
"334695817419663653689419630430543720283",
"151252523157135058326999220974551728079",
"128077454089028829022146287673226726410",
"51584140627476515304761115604500156521",
"66828793008889379732497239635535560240",
"119016709104423746287155870368458173600",
"204737428784123304028132736892762095887",
"13578157013823600323780596516277411843"
]
},
"signature_type": "Line"
}
]