CVE-2022-48363: High severity linuxfoundation Automotive Grade Linux vulnerability
In MPD before 0.23.8, as used on Automotive Grade Linux and other platforms, the PipeWire output plugin mishandles a Drain call in certain situations involving truncated files. Eventually there is an assertion failure in libmpdclient because libqtappfw passes in a NULL pointer.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48363?
CVE-2022-48363 has a critical severity due to the potential for assertion failures caused by the mishandling of a Drain call.
How do I fix CVE-2022-48363?
To fix CVE-2022-48363, upgrade to MPD version 0.23.8 or later where the vulnerability has been addressed.
What systems are affected by CVE-2022-48363?
CVE-2022-48363 affects platforms using the PipeWire output plugin in MPD versions prior to 0.23.8, specifically Automotive Grade Linux.
What can happen if CVE-2022-48363 is exploited?
If exploited, CVE-2022-48363 can lead to an assertion failure in libmpdclient, causing potential disruption in the application.
Is CVE-2022-48363 a common vulnerability?
CVE-2022-48363 is less common as it specifically targets certain versions of MPD within the Automotive Grade Linux environment.