CVE-2022-3303 is a race condition vulnerability in the Linux kernel's sound subsystem, specifically affecting Debian and other Linux distributions. This flaw, due to improper locking during SNDCTL_DSP_SYNC ioctl handling, can lead to a NULL pointer dereference. A local, privileged user (root or audio group member) could exploit this to cause a system crash, resulting in a denial-of-service condition. The vulnerability has a CVSS score of 4.7 (Medium) with high attack complexity, and there is no evidence of active exploitation, public exploit code, or significant community discussion.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
< 6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc1:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc2:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc3:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:6.0:rc4:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.1 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.4 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
A race condition flaw was found in the Linux kernel sound subsystem due to improper locking. It could lead to a NULL pointer dereference while handling the SNDCTL_DSP_SYNC ioctl. A privileged local user (root or member of the audio group) could use this flaw to crash the system resulting in a denial of service condition
Sep 13, 2022kernel: race condition in snd_pcm_oss_sync leads to NULL pointer dereference
Sep 4, 2022