CVE-2022-48994
published 2024-10-21CVE-2022-48994: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel…
PriorityP421medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.24%
14.7th percentile
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.
seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes
matching snd_seq_dump_func_t. Adjust this and remove the casts. There
are not resulting binary output differences.
This was found as a result of Clang's new -Wcast-function-type-strict
flag, which is more sensitive than the simpler -Wcast-function-type,
which only checks for type width mismatches.
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 6.1.4-1 (bookworm) | linux 6.1.4-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < b38486e82ecb9f3046e0184205f6b61408fc40c9 | b38486e82ecb9f3046e0184205f6b61408fc40c9 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < e385360705a0b346bdb57ce938249175d0613b8a | e385360705a0b346bdb57ce938249175d0613b8a |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 2f46e95bf344abc4e74f8158901d32a869e0adb6 | 2f46e95bf344abc4e74f8158901d32a869e0adb6 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 63badfed200219ca656968725f1a43df293ac936 | 63badfed200219ca656968725f1a43df293ac936 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 15c42ab8d43acb73e2eba361ad05822c0af0ecfa | 15c42ab8d43acb73e2eba361ad05822c0af0ecfa |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < fccd454129f6a0739651f7f58307cdb631fd6e89 | fccd454129f6a0739651f7f58307cdb631fd6e89 |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 13ee8fb5410b740c8dd2867d3557c7662f7dda2d | 13ee8fb5410b740c8dd2867d3557c7662f7dda2d |
| linux | linux | >= 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 < 05530ef7cf7c7d700f6753f058999b1b5099a026 | 05530ef7cf7c7d700f6753f058999b1b5099a026 |
| linux | linux_kernel | < 4.9.336 | 4.9.336 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 5.10.162-1 | 5.10.162-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 6.1.4-1 | 6.1.4-1 |
| linux | linux_kernel | >= 0 < 3.13.0-204.255 | 3.13.0-204.255 |
| linux | linux_kernel | >= 0 < 4.4.0-266.300 | 4.4.0-266.300 |
| linux | linux_kernel | >= 4.10 < 4.14.302 | 4.14.302 |
| linux | linux_kernel | >= 4.15 < 4.19.269 | 4.19.269 |
| linux | linux_kernel | >= 4.20 < 5.4.227 | 5.4.227 |
| linux | linux_kernel | >= 5.11 < 5.15.83 | 5.15.83 |
| linux | linux_kernel | >= 5.16 < 6.0.13 | 6.0.13 |
| linux | linux_kernel | >= 5.5 < 5.10.159 | 5.10.159 |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv7.8HIGH
vendor_ubuntu7.8HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
OSV
linux-lts-xenial vulnerabilities
osv·2025-03-13·CVSS 7.8
[HIGH] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure;
- BPF subsystem;
- Netfilter;
- Network sockets;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Netlink;
- TIPC protocol;
- Wireless networking;
- ALSA framework;
(
OSV
linux-kvm vulnerabilities
osv·2025-03-11·CVSS 7.8
CVE-2025-0927 [HIGH] linux-kvm vulnerabilities
linux-kvm vulnerabilities
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure
OSV
linux, linux-aws vulnerabilities
osv·2025-03-05·CVSS 7.8
[HIGH] linux, linux-aws vulnerabilities
linux, linux-aws vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure;
- BPF subsystem;
- Netfilter;
- Network sockets;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- IPv6 networking;
- Netlink;
- TIPC protocol;
- Wireless networking;
- ALSA framework;
(
OSV
linux vulnerabilities
osv·2025-03-05·CVSS 5.5
CVE-2023-52880 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Media drivers;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- ALSA framework;
(CVE-2023-52880, CVE-2024-43900, CVE-2024-36964, CVE-2024-50233,
CVE-2022-48994)
OSV
CVE-2022-48994: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang'
osv·2024-10-21·CVSS 5.5
CVE-2022-48994 [MEDIUM] CVE-2022-48994: In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang'
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-functio
GHSA
GHSA-5wgm-phpv-mgx7: In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
With clan
ghsa_unreviewed·2024-10-21
CVE-2022-48994 [MEDIUM] GHSA-5wgm-phpv-mgx7: In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
With clan
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.
seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes
matching snd_seq_dump_func_t. Adjust this and remove the casts. There
are not resulting binary output differences.
This was found as a result of Clang's new -Wcast-function-type-strict
flag, which is more sensitive than the simpler -Wcast-fun
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-03-13·CVSS 7.8
CVE-2024-43893 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure;
- BPF subsystem;
- Netfilter;
- Network sockets;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- IPv6 networking;
-
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-03-11·CVSS 7.8
CVE-2024-41064 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Attila Szász discovered that the HFS+ file system implementation in the
Linux Kernel contained a heap overflow vulnerability. An attacker could use
a specially crafted file system image that, when mounted, could cause a
denial of service (system crash) or possibly execute arbitrary code.
(CVE-2025-0927)
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file sy
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-03-05·CVSS 5.5
CVE-2023-52880 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- Media drivers;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- ALSA framework;
(CVE-2023-52880, CVE-2024-43900, CVE-2024-36964, CVE-2024-50233,
CVE-2022-48994)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed.
U
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2025-03-05·CVSS 7.8
CVE-2024-40981 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
Several security issues were discovered in the Linux kernel.
An attacker could possibly use these to compromise the system.
This update corrects flaws in the following subsystems:
- PowerPC architecture;
- Block layer subsystem;
- GPIO subsystem;
- GPU drivers;
- Media drivers;
- Network drivers;
- SCSI subsystem;
- Direct Digital Synthesis drivers;
- TTY drivers;
- 9P distributed file system;
- JFS file system;
- NILFS2 file system;
- File systems infrastructure;
- BPF subsystem;
- Netfilter;
- Network sockets;
- Memory management;
- Amateur Radio drivers;
- B.A.T.M.A.N. meshing protocol;
- Bluetooth subsystem;
- Ethernet bridge;
- Networking core;
- IPv4 networking;
- IPv6 networking;
-
Red Hat
kernel: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
vendor_redhat·2024-10-21·CVSS 5.5
CVE-2022-48994 [MEDIUM] CWE-843 kernel: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
kernel: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG),
indirect call targets are validated against the expected function
pointer prototype to make sure the call target is valid to help mitigate
ROP attacks. If they are not identical, there is a failure at run time,
which manifests as either a kernel panic or thread getting killed.
seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes
matching snd_seq_dump_func_t. Adjust this and remove the casts. There
are not resulting binary output differences.
This was found as a result of Clang's new -Wcast-fu
Debian
CVE-2022-48994: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: ...
vendor_debian·2022·CVSS 5.5
CVE-2022-48994 [MEDIUM] CVE-2022-48994: linux - In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: ...
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event With clang's kernel control flow integrity (kCFI, CONFIG_CFI_CLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed. seq_copy_in_user() and seq_copy_in_kernel() did not have prototypes matching snd_seq_dump_func_t. Adjust this and remove the casts. There are not resulting binary output differences. This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-functio
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
https://git.kernel.org/stable/c/05530ef7cf7c7d700f6753f058999b1b5099a026https://git.kernel.org/stable/c/13ee8fb5410b740c8dd2867d3557c7662f7dda2dhttps://git.kernel.org/stable/c/15c42ab8d43acb73e2eba361ad05822c0af0ecfahttps://git.kernel.org/stable/c/2f46e95bf344abc4e74f8158901d32a869e0adb6https://git.kernel.org/stable/c/63badfed200219ca656968725f1a43df293ac936https://git.kernel.org/stable/c/b38486e82ecb9f3046e0184205f6b61408fc40c9https://git.kernel.org/stable/c/e385360705a0b346bdb57ce938249175d0613b8ahttps://git.kernel.org/stable/c/fccd454129f6a0739651f7f58307cdb631fd6e89
2024-10-21
Published