CVE-2022-48994: ALSA: seq: Fix function prototype mismatch in snd_seq_expand_var_event
In the Linux kernel, the following vulnerability has been resolved:
ALSA: seq: Fix function prototype mismatch in sndseqexpandvarevent
With clang's kernel control flow integrity (kCFI, CONFIGCFICLANG), indirect call targets are validated against the expected function pointer prototype to make sure the call target is valid to help mitigate ROP attacks. If they are not identical, there is a failure at run time, which manifests as either a kernel panic or thread getting killed.
seqcopyinuser() and seqcopyinkernel() did not have prototypes matching sndseqdumpfunct. Adjust this and remove the casts. There are not resulting binary output differences.
This was found as a result of Clang's new -Wcast-function-type-strict flag, which is more sensitive than the simpler -Wcast-function-type, which only checks for type width mismatches.
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2022-48994?
CVE-2022-48994 has a medium severity rating due to its impact on the ALSA subsystem of the Linux kernel.
How do I fix CVE-2022-48994?
To fix CVE-2022-48994, update your Linux kernel to a version that includes the patch for this vulnerability.
What versions of the Linux kernel are affected by CVE-2022-48994?
CVE-2022-48994 affects Linux kernel versions prior to 6.1-rc1 and multiple versions within certain ranges up to that point.
What are the potential impacts of CVE-2022-48994?
The potential impacts of CVE-2022-48994 include exploitation that could lead to information disclosure or system compromise.
Is CVE-2022-48994 a local or remote vulnerability?
CVE-2022-48994 is considered a local vulnerability, as it requires local access to exploit.