#VU99214 Input validation error in Linux kernel - CVE-2022-48992

Vulnerability identifier: #VU99214

Vulnerability risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-48992

CWE-ID: CWE-20

Exploitation vector: Local

Exploit availability: No

Vulnerable software:
Linux kernel
Operating systems & Components / Operating system

Vendor: Linux Foundation

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to improper input validation within the dpcm_be_reparent() function in sound/soc/soc-pcm.c. A local user can perform a denial of service (DoS) attack.

Mitigation
Install update from vendor's website.

Vulnerable software versions

Linux kernel: All versions

---

External links
https://git.kernel.org/stable/c/0760acc2e6598ad4f7bd3662db2d907ef0838139
https://git.kernel.org/stable/c/d4dd21a79dbb862d2ebcf9ed90e646416009ff0d
https://git.kernel.org/stable/c/e7166d6821c15f3516bcac8ae3f155924da1908c
https://git.kernel.org/stable/c/f2ba66d8738584d124aff4e760ed1337f5f6dfb6
https://git.kernel.org/stable/c/f6f45e538328df9ce66aa61bafee1a5717c4b700
https://git.kernel.org/stable/c/9f74b9aa8d58c18927bb9b65dd5ba70a5fd61615
https://git.kernel.org/stable/c/34a9796bf0684bfd54e96a142560d560c21c983b
https://git.kernel.org/stable/c/db8f91d424fe0ea6db337aca8bc05908bbce1498

---

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.