CVE-2022-49291

Name of the Vulnerable Software and Affected Versions Linux kernel (affected versions not specified)

Description The issue is related to the Advanced Linux Sound Architecture (ALSA) in the Linux kernel, where concurrent calls to hw params and hw free ioctls can result in a use-after-free (UAF) condition due to the lack of proper checks or protection. This is because the existing PCM stream lock cannot protect the entire ioctl operation. To address this, a new mutex called runtime->buffer mutex has been introduced to protect these concurrent calls.

Recommendations For the affected Linux kernel versions, applying the patch that introduces the runtime->buffer mutex and modifies the hw params and hw free ioctl code paths is recommended. This involves updating the kernel with the fix that includes the new mutex and the modified functions for code simplicity.