CVE-2022-49733 ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
A race condition in the Linux kernel ALSA OSS PCM driver can lead to a NULL pointer dereference and system crash.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2022-49733?
CVE-2022-49733 is a high-severity vulnerability in Linux kernel, published on 2 Mar 2025. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
In the Linux kernel, the following vulnerability has been resolved:
ALSA: pcm: oss: Fix race at SNDCTL_DSP_SYNC
There is a small race window at snd_pcm_oss_sync() that is called from OSS PCM SNDCTL_DSP_SYNC ioctl; namely the function calls snd_pcm_oss_make_ready() at first, then takes the params_lock mutex for the rest. When the stream is set up again by another thread between them, it leads to inconsistency, and may result in unexpected results such as NULL dereference of OSS buffer as a fuzzer spotted recently.
The fix is simply to cover snd_pcm_oss_make_ready() call into the same params_lock mutex with snd_pcm_oss_make_ready_locked() variant.
Which versions are affected by CVE-2022-49733?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2022-49733?
Apply the vendor's patch.
Is CVE-2022-49733 being exploited?
There is no known exploitation of CVE-2022-49733 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2022-49733, GHSA-73xw-qxgf-j8c4, UBUNTU-CVE-2022-49733.