CVE-2022-48702— ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
Get alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2022-48702
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc()
Source: NVD (National Vulnerability Database)
Vulnerability Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: emu10k1: Fix out of bounds access in snd_emu10k1_pcm_channel_alloc() The voice allocator sometimes begins allocating from near the end of the array and then wraps around, however snd_emu10k1_pcm_channel_alloc() accesses the newly allocated voices as if it never wrapped around. This results in out of bounds access if the first voice has a high enough index so that first_voice + requested_voice_count > NUM_G (64). The more voices are requested, the more likely it is for this to occur. This was initially discovered using PipeWire, however it can be reproduced by calling aplay multiple times with 16 channels: aplay -r 48000 -D plughw:CARD=Live,DEV=3 -c 16 /dev/zero UBSAN: array-index-out-of-bounds in sound/pci/emu10k1/emupcm.c:127:40 index 65 is out of range for type 'snd_emu10k1_voice [64]' CPU: 1 PID: 31977 Comm: aplay Tainted: G W IOE 6.0.0-rc2-emu10k1+ #7 Hardware name: ASUSTEK COMPUTER INC P5W DH Deluxe/P5W DH Deluxe, BIOS 3002 07/22/2010 Call Trace: <TASK> dump_stack_lvl+0x49/0x63 dump_stack+0x10/0x16 ubsan_epilogue+0x9/0x3f __ubsan_handle_out_of_bounds.cold+0x44/0x49 snd_emu10k1_playback_hw_params+0x3bc/0x420 [snd_emu10k1] snd_pcm_hw_params+0x29f/0x600 [snd_pcm] snd_pcm_common_ioctl+0x188/0x1410 [snd_pcm] ? exit_to_user_mode_prepare+0x35/0x170 ? do_syscall_64+0x69/0x90 ? syscall_exit_to_user_mode+0x26/0x50 ? do_syscall_64+0x69/0x90 ? exit_to_user_mode_prepare+0x35/0x170 snd_pcm_ioctl+0x27/0x40 [snd_pcm] __x64_sys_ioctl+0x95/0xd0 do_syscall_64+0x5c/0x90 ? do_syscall_64+0x69/0x90 ? do_syscall_64+0x69/0x90 entry_SYSCALL_64_after_hwframe+0x63/0xcd
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Title
Linux kernel 安全漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Linux kernel是美国Linux基金会的开源操作系统Linux所使用的内核。 Linux kernel存在安全漏洞，该漏洞源于snd_emu10k1_pcm_channel_alloc函数允许越界访问。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2022-48702
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2022-48702
请登录查看更多情报信息。
Same Patch Batch · Linux · 2024-05-03 · 25 CVEs total
| CVE-2022-48693 | soc: brcmstb: pm-arm: Fix refcount leak and __iomem leak bugs | |
| CVE-2022-48705 | wifi: mt76: mt7921e: fix crash in chip reset fail | |
| CVE-2022-48704 | drm/radeon: add a force flush to delay work when radeon | |
| CVE-2022-48695 | scsi: mpt3sas: Fix use-after-free warning | |
| CVE-2022-48690 | ice: Fix DMA mappings leak | |
| CVE-2022-48703 | thermal/int340x_thermal: handle data_vault when the value is ZERO_SIZE_PTR | |
| CVE-2022-48701 | ALSA: usb-audio: Fix an out-of-bounds bug in __snd_usb_parse_audio_interface() | |
| CVE-2022-48699 | sched/debug: fix dentry leak in update_sched_domain_debugfs | |
| CVE-2022-48698 | drm/amd/display: fix memory leak when using debugfs_lookup() | |
| CVE-2022-48697 | nvmet: fix a use-after-free | |
| CVE-2022-48696 | regmap: spi: Reserve space for register address/padding | |
| CVE-2022-48694 | RDMA/irdma: Fix drain SQ hang with no completion | |
| CVE-2022-48670 | peci: cpu: Fix use-after-free in adev_release() | |
| CVE-2022-48692 | RDMA/srp: Set scmnd->result only when scmnd is not NULL | |
| CVE-2022-48691 | netfilter: nf_tables: clean up hook list when offload flags check fails | |
| CVE-2022-48689 | tcp: TX zerocopy should not sense pfmemalloc status | |
| CVE-2022-48688 | i40e: Fix kernel crash during module removal | |
| CVE-2022-48687 | ipv6: sr: fix out-of-bounds read when setting HMAC data. | |
| CVE-2022-48686 | nvme-tcp: fix UAF when detecting digest errors | |
| CVE-2022-48675 | IB/core: Fix a nested dead lock as part of ODP flow |
Showing top 20 of 25 CVEs. View all on vendor page → →
IV. Related Vulnerabilities
Same product: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
Same vendor: Linux
- CVE-2026-43500
rxrpc: Also unshare DATA/RESPONSE packets when paged frags a - CVE-2026-43475
scsi: storvsc: Fix scheduling while atomic on PREEMPT_RT - CVE-2026-43474
fs: init flags_valid before calling vfs_fileattr_get - CVE-2026-43473
scsi: mpi3mr: Add NULL checks when resetting request and rep - CVE-2026-43472
unshare: fix unshare_fs() handling
V. Comments for CVE-2022-48702
No comments yet