CVE-2022-49292: ALSA: oss: Fix PCM OSS buffer allocation overflow

Published Feb 26, 2025
·
Updated

In the Linux kernel, the following vulnerability has been resolved:

ALSA: oss: Fix PCM OSS buffer allocation overflow

We've got syzbot reports hitting INTMAX overflow at vmalloc() allocation that is called from sndpcmplugalloc(). Although we apply the restrictions to input parameters, it's based only on the hwparams of the underlying PCM device. Since the PCM OSS layer allocates a temporary buffer for the data conversion, the size may become unexpectedly large when more channels or higher rates is given; in the reported case, it went over INTMAX, hence it hits WARNON().

This patch is an attempt to avoid such an overflow and an allocation for too large buffers. First off, it adds the limit of 1MB as the upper bound for period bytes. This must be large enough for all use cases, and we really don't want to handle a larger temporary buffer than this size. The size check is performed at two places, where the original period bytes is calculated and where the plugin buffer size is calculated.

In addition, the driver uses arraysize() and array3size() for multiplications to catch overflows for the converted period size and buffer bytes.

Affected Software

159 affected componentsFixes available
Linux Linux kernel
Linux Linux kernel<4.19.237
Linux Linux kernel>=4.20<5.4.188
Linux Linux kernel>=5.5<5.10.109
Linux Linux kernel>=5.11<5.15.32
Linux Linux kernel>=5.16<5.16.18
Linux Linux kernel=5.17
debian/linux<5.17.3-1
5.17.3-1
debian/linux<5.17.3-1
5.17.3-1
debian/linux<5.17.3-1
5.17.3-1
debian/linux
6.1.176-16.1.190-16.12.107-16.12.115-27.2.12-17.2.15-1
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-azure*
ubuntu/linux-lts-xenial*
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-hwe*
ubuntu/linux-azure*
ubuntu/linux-gcp*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-kvm*
ubuntu/linux-oracle*
ubuntu/linux-fips*
ubuntu/linux-fips*
ubuntu/linux-aws-5.4<5.4.0-1078.84~18.04.1
5.4.0-1078.84~18.04.1
ubuntu/linux-azure-5.4<5.4.0-1083.87~18.04.1
5.4.0-1083.87~18.04.1
ubuntu/linux-gcp-5.4<5.4.0-1078.84~18.04.1
5.4.0-1078.84~18.04.1
ubuntu/linux-hwe-5.4<5.4.0-117.132~18.04.1
5.4.0-117.132~18.04.1
ubuntu/linux-ibm-5.4<5.4.0-1028.32~18.04.1
5.4.0-1028.32~18.04.1
ubuntu/linux-oracle-5.4<5.4.0-1076.83~18.04.1
5.4.0-1076.83~18.04.1
ubuntu/linux-raspi-5.4<5.4.0-1065.75~18.04.1
5.4.0-1065.75~18.04.1
ubuntu/linux*
ubuntu/linux-aws*
ubuntu/linux-aws-5.0*
ubuntu/linux-aws-5.3*
ubuntu/linux-azure*
ubuntu/linux-azure-4.15*
ubuntu/linux-azure-5.3*
ubuntu/linux-azure-edge*
ubuntu/linux-gcp*
ubuntu/linux-gcp-4.15*
ubuntu/linux-gcp-5.3*
ubuntu/linux-gke-4.15*
ubuntu/linux-gke-5.4*
ubuntu/linux-gkeop-5.4*
ubuntu/linux-hwe*
ubuntu/linux-hwe-edge*
ubuntu/linux-kvm*
ubuntu/linux-oem*
ubuntu/linux-oracle*
ubuntu/linux-oracle-5.0*
ubuntu/linux-oracle-5.3*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.4.0-117.132
5.4.0-117.132
ubuntu/linux-aws<5.4.0-1078.84
5.4.0-1078.84
ubuntu/linux-azure<5.4.0-1083.87
5.4.0-1083.87
ubuntu/linux-azure-5.15<5.15.0-1008.9~20.04.1
5.15.0-1008.9~20.04.1
ubuntu/linux-bluefield<5.4.0-1040.44
5.4.0-1040.44
ubuntu/linux-gcp<5.4.0-1078.84
5.4.0-1078.84
ubuntu/linux-hwe-5.15<5.15.0-41.44~20.04.1
5.15.0-41.44~20.04.1
ubuntu/linux-ibm<5.4.0-1026.29
5.4.0-1026.29
ubuntu/linux-intel-iotg-5.15<5.15.0-1008.11~20.04.1
5.15.0-1008.11~20.04.1
ubuntu/linux-iot<5.4.0-1004.6
5.4.0-1004.6
ubuntu/linux-kvm<5.4.0-1068.72
5.4.0-1068.72
ubuntu/linux-lowlatency-hwe-5.15<5.15.0-42.45~20.04.1
5.15.0-42.45~20.04.1
ubuntu/linux-oracle<5.4.0-1076.83
5.4.0-1076.83
ubuntu/linux-raspi<5.4.0-1065.75
5.4.0-1065.75
ubuntu/linux-aws-5.11*
ubuntu/linux-aws-5.13*
ubuntu/linux-aws-5.8*
ubuntu/linux-azure-5.11*
ubuntu/linux-azure-5.13*
ubuntu/linux-azure-5.8*
ubuntu/linux-azure-fde*
ubuntu/linux-gcp-5.11*
ubuntu/linux-gcp-5.13*
ubuntu/linux-gcp-5.8*
ubuntu/linux-gke*
ubuntu/linux-gke-5.15*
ubuntu/linux-gkeop*
ubuntu/linux-gkeop-5.15*
ubuntu/linux-hwe-5.11*
ubuntu/linux-hwe-5.13*
ubuntu/linux-hwe-5.8*
ubuntu/linux-intel-5.13*
ubuntu/linux-oem-5.10*
ubuntu/linux-oem-5.13*
ubuntu/linux-oem-5.6*
ubuntu/linux-oracle-5.11*
ubuntu/linux-oracle-5.13*
ubuntu/linux-oracle-5.8*
ubuntu/linux-raspi2*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.11*
ubuntu/linux-riscv-5.8*
ubuntu/linux-aws-fips<5.4.0-1078.84+fips1
5.4.0-1078.84+fips1
ubuntu/linux-azure-fips<5.4.0-1083.87+fips1
5.4.0-1083.87+fips1
ubuntu/linux-fips<5.4.0-1054.61
5.4.0-1054.61
ubuntu/linux-gcp-fips<5.4.0-1078.84+fips1
5.4.0-1078.84+fips1
ubuntu/linux-aws-fips*
ubuntu/linux-azure-fips*
ubuntu/linux-fips*
ubuntu/linux-gcp-fips*
ubuntu/linux<5.15.0-37.39
5.15.0-37.39
ubuntu/linux-allwinner-5.19*
ubuntu/linux-aws<5.15.0-1011.14
5.15.0-1011.14
ubuntu/linux-aws-5.19*
ubuntu/linux-aws-6.2*
ubuntu/linux-aws-6.5*
ubuntu/linux-azure<5.15.0-1010.12
5.15.0-1010.12
ubuntu/linux-azure-5.19*
ubuntu/linux-azure-6.2*
ubuntu/linux-azure-6.5*
ubuntu/linux-azure-fde-5.19*
ubuntu/linux-azure-fde-6.2*
ubuntu/linux-gcp<5.15.0-1008.12
5.15.0-1008.12
ubuntu/linux-gcp-5.19*
ubuntu/linux-gcp-6.2*
ubuntu/linux-gcp-6.5*
ubuntu/linux-gke<5.15.0-1008.10
5.15.0-1008.10
ubuntu/linux-hwe-5.19*
ubuntu/linux-hwe-6.2*
ubuntu/linux-hwe-6.5*
ubuntu/linux-ibm<5.15.0-1007.8
5.15.0-1007.8
ubuntu/linux-intel-iot-realtime*
ubuntu/linux-intel-iotg<5.15.0-1008.11
5.15.0-1008.11
ubuntu/linux-kvm<5.15.0-1010.11
5.15.0-1010.11
ubuntu/linux-lowlatency<5.15.0-37.39
5.15.0-37.39
ubuntu/linux-lowlatency-hwe-5.19*
ubuntu/linux-lowlatency-hwe-6.2*
ubuntu/linux-lowlatency-hwe-6.5*
ubuntu/linux-nvidia-6.2*
ubuntu/linux-nvidia-6.5*
ubuntu/linux-oem-5.17*
ubuntu/linux-oem-6.0*
ubuntu/linux-oem-6.1*
ubuntu/linux-oem-6.5*
ubuntu/linux-oracle<5.15.0-1009.12
5.15.0-1009.12
ubuntu/linux-oracle-6.5*
ubuntu/linux-raspi<5.15.0-1011.13
5.15.0-1011.13
ubuntu/linux-realtime*
ubuntu/linux-riscv*
ubuntu/linux-riscv-5.19*
ubuntu/linux-riscv-6.5*
ubuntu/linux-starfive-5.19*
ubuntu/linux-starfive-6.2*
ubuntu/linux-starfive-6.5*
ubuntu/linux-realtime<5.15.0-1014.14
5.15.0-1014.14
ubuntu/linux-raspi-realtime*
ubuntu/linux-vmware*

Remediation

Recommended actions to resolve this vulnerability, in priority order.

  1. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 5.17.3-1
  2. Upgrade

    Upgrade debian/linux to a version that resolves this vulnerability.

    Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.115-2Fixed in 7.2.12-1Fixed in 7.2.15-1
  3. Upgrade

    Upgrade ubuntu/linux-aws-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84~18.04.1
  4. Upgrade

    Upgrade ubuntu/linux-azure-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87~18.04.1
  5. Upgrade

    Upgrade ubuntu/linux-gcp-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84~18.04.1
  6. Upgrade

    Upgrade ubuntu/linux-hwe-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-117.132~18.04.1
  7. Upgrade

    Upgrade ubuntu/linux-ibm-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1028.32~18.04.1
  8. Upgrade

    Upgrade ubuntu/linux-oracle-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1076.83~18.04.1
  9. Upgrade

    Upgrade ubuntu/linux-raspi-5.4 to a version that resolves this vulnerability.

    Fixed in 5.4.0-1065.75~18.04.1
  10. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.4.0-117.132
  11. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84
  12. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87
  13. Upgrade

    Upgrade ubuntu/linux-azure-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.9~20.04.1
  14. Upgrade

    Upgrade ubuntu/linux-bluefield to a version that resolves this vulnerability.

    Fixed in 5.4.0-1040.44
  15. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84
  16. Upgrade

    Upgrade ubuntu/linux-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-41.44~20.04.1
  17. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1026.29
  18. Upgrade

    Upgrade ubuntu/linux-intel-iotg-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.11~20.04.1
  19. Upgrade

    Upgrade ubuntu/linux-iot to a version that resolves this vulnerability.

    Fixed in 5.4.0-1004.6
  20. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.4.0-1068.72
  21. Upgrade

    Upgrade ubuntu/linux-lowlatency-hwe-5.15 to a version that resolves this vulnerability.

    Fixed in 5.15.0-42.45~20.04.1
  22. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.4.0-1076.83
  23. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.4.0-1065.75
  24. Upgrade

    Upgrade ubuntu/linux-aws-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84+fips1
  25. Upgrade

    Upgrade ubuntu/linux-azure-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1083.87+fips1
  26. Upgrade

    Upgrade ubuntu/linux-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1054.61
  27. Upgrade

    Upgrade ubuntu/linux-gcp-fips to a version that resolves this vulnerability.

    Fixed in 5.4.0-1078.84+fips1
  28. Upgrade

    Upgrade ubuntu/linux to a version that resolves this vulnerability.

    Fixed in 5.15.0-37.39
  29. Upgrade

    Upgrade ubuntu/linux-aws to a version that resolves this vulnerability.

    Fixed in 5.15.0-1011.14
  30. Upgrade

    Upgrade ubuntu/linux-azure to a version that resolves this vulnerability.

    Fixed in 5.15.0-1010.12
  31. Upgrade

    Upgrade ubuntu/linux-gcp to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.12
  32. Upgrade

    Upgrade ubuntu/linux-gke to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.10
  33. Upgrade

    Upgrade ubuntu/linux-ibm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1007.8
  34. Upgrade

    Upgrade ubuntu/linux-intel-iotg to a version that resolves this vulnerability.

    Fixed in 5.15.0-1008.11
  35. Upgrade

    Upgrade ubuntu/linux-kvm to a version that resolves this vulnerability.

    Fixed in 5.15.0-1010.11
  36. Upgrade

    Upgrade ubuntu/linux-lowlatency to a version that resolves this vulnerability.

    Fixed in 5.15.0-37.39
  37. Upgrade

    Upgrade ubuntu/linux-oracle to a version that resolves this vulnerability.

    Fixed in 5.15.0-1009.12
  38. Upgrade

    Upgrade ubuntu/linux-raspi to a version that resolves this vulnerability.

    Fixed in 5.15.0-1011.13
  39. Upgrade

    Upgrade ubuntu/linux-realtime to a version that resolves this vulnerability.

    Fixed in 5.15.0-1014.14
  40. Compensating control

    In the ALSA PCM OSS layer, enforce a 1MB upper bound for period bytes and use overflow-checking array_size() and array3_size() for converted period-size and buffer-byte multiplications before allocating temporary buffers.

Event History

Feb 26, 2025
CVE Published
via MITRE·01:56 AM
Data Sourced
via MITRE·01:56 AM
DescriptionSeverity
Data Sourced
via OSV·07:01 AM
DescriptionSeverityAffected Software
Event
via OSV·07:01 AM
Data Sourced
via NVD·07:01 AM
RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

1

What is the severity of CVE-2022-49292?

CVE-2022-49292 has a moderate severity level due to the buffer allocation overflow that can lead to potential denial of service.

2

How do I fix CVE-2022-49292?

To fix CVE-2022-49292, you should update your Linux kernel to a version where this vulnerability has been patched.

3

Which versions of Linux kernel are affected by CVE-2022-49292?

CVE-2022-49292 affects Linux kernel versions from 4.20 up to, but not including, 5.17.

4

What impact does CVE-2022-49292 have on affected systems?

The impact of CVE-2022-49292 includes the risk of denial of service due to an overflow during PCM OSS buffer allocation.

5

Is there a workaround for CVE-2022-49292?

Currently, the best approach for CVE-2022-49292 is to apply the official patches provided in the updated kernel versions.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203