CVE-2022-3170 — Out-of-bounds Read in Kernel

CWE-125 — Out-of-bounds Read6 documents6 sources
Severity
7.8HIGHNVD
EPSS
0.0%
top 85.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linux KernelDebian LinuxMsrc Cbl2 Kernel 5.15.70.1-1 ON CBL Mariner 2.0+1 more
Timeline
PublishedSep 13
Latest updateSep 14

Description

An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5linux/linux_kernelfixed in kernel 6.0-rc4
▶debiandebian/linux

Patches

Patch: github.com ↗Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-rj8g-9xvh-crrr: An out-of-bounds access issue was found in the Linux kernel sound subsystem↗2022-09-14
▶
OSV
CVE-2022-3170: An out-of-bounds access issue was found in the Linux kernel sound subsystem↗2022-09-13
▶

📋Vendor Advisories

3
Microsoft
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a special↗2022-09-13
▶
Red Hat
kernel: ALSA: control: out-of-bounds access in get_ctl_id_hash()↗2022-08-24
▶
Debian
CVE-2022-3170: linux - An out-of-bounds access issue was found in the Linux kernel sound subsystem. It ...↗2022
▶
CVE-2022-3170 — Out-of-bounds Read in Linux Kernel | cvebase