CVE-2022-48992

Q: What is the severity of CVE-2022-48992?

CVE-2022-48992 has a CVSS score of 5.5 (MEDIUM). This CVE-2022-48992 is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (ALSA System on Chip) subsystem. It allows local attackers to cause a kernel panic (denial of service) by triggering a specific condition in the dpcm_be_reparent function. This affects systems running vulnerable Linux kernel versions with ASoC audio components.

5.5 MEDIUM

Denial of Service

📋 TL;DR

This CVE-2022-48992 is a NULL pointer dereference vulnerability in the Linux kernel's ASoC (ALSA System on Chip) subsystem. It allows local attackers to cause a kernel panic (denial of service) by triggering a specific condition in the dpcm_be_reparent function. This affects systems running vulnerable Linux kernel versions with ASoC audio components.

💻 Affected Systems

Products:

Linux kernel

Versions: Specific vulnerable kernel versions with the ASoC soc-pcm component (exact versions depend on distribution backports)

Operating Systems: Linux distributions using affected kernel versions

Default Config Vulnerable: ⚠️ Yes

Notes: Requires ASoC subsystem to be enabled/used. Most desktop and server distributions with audio support are potentially affected.

📦 What is this software?

Linux Kernel by Linux

The Linux Kernel is the core component of the Linux operating system, serving as the critical interface between computer hardware and software processes. As the heart of millions of servers, cloud infrastructure, embedded systems, Android devices, and IoT deployments worldwide, the Linux Kernel mana...

Learn more about Linux Kernel →

⚠️ Risk & Real-World Impact

🔴

Worst Case

Local attacker triggers kernel panic leading to system crash and denial of service, potentially causing data loss or service disruption.

🟠

Likely Case

Local user or process causes system crash through fuzzing or malformed audio operations, resulting in temporary denial of service.

🟢

If Mitigated

System remains stable as the NULL check prevents dereferencing, with no security impact beyond normal operation.

🌐 Internet-Facing: LOW - Requires local access to exploit; not directly exploitable over network.

🏢 Internal Only: MEDIUM - Local users or processes could trigger the vulnerability, potentially causing system instability in multi-user environments.

🎯 Exploit Status

Public PoC: ✅ No

Weaponized: NO

Unauthenticated Exploit: ✅ No

Complexity: MEDIUM

Discovered during fuzzing tests. Requires local access and specific conditions to trigger the NULL pointer dereference.

🛠️ Fix & Mitigation

✅ Official Fix

Patch Version: Kernel versions with commits 0760acc2e6598ad4f7bd3662db2d907ef0838139 or later

Vendor Advisory: https://git.kernel.org/stable/c/0760acc2e6598ad4f7bd3662db2d907ef0838139

Restart Required: Yes

Instructions:

1. Update Linux kernel to patched version from your distribution. 2. For custom kernels, apply the NULL check patch to soc/soc-pcm.c. 3. Reboot system to load new kernel.

🔧 Temporary Workarounds

Disable ASoC audio subsystem

linux

Remove or disable ASoC kernel modules to prevent exploitation

modprobe -r snd_soc_core
echo 'blacklist snd_soc_core' >> /etc/modprobe.d/blacklist.conf

🧯 If You Can't Patch

Restrict local user access to systems with vulnerable kernels
Implement strict process isolation and resource limits to minimize impact

🔍 How to Verify

Check if Vulnerable:

Check kernel version and if ASoC modules are loaded: 'uname -r' and 'lsmod | grep snd_soc'

Check Version:

uname -r

Verify Fix Applied:

Verify kernel version is patched and check for NULL pointer checks in soc-pcm source code

📡 Detection & Monitoring

Log Indicators:

Kernel panic messages in /var/log/kern.log or dmesg
NULL pointer dereference errors in kernel logs

Network Indicators:

None - local vulnerability only

SIEM Query:

source="kernel" AND "NULL pointer dereference" AND "soc-pcm"

📊 Metadata

CVE ID: CVE-2022-48992

CVSS v3 Score: 5.5 (MEDIUM)

CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

CWE: CWE-476

Published: October 21, 2024

Last Updated: October 25, 2024

📋 TL;DR

💻 Affected Systems

📦 What is this software?

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

Linux Kernel by Linux

⚠️ Risk & Real-World Impact

Worst Case

Likely Case

If Mitigated

🎯 Exploit Status

🛠️ Fix & Mitigation

✅ Official Fix

Instructions:

🔧 Temporary Workarounds

Disable ASoC audio subsystem

🧯 If You Can't Patch

🔍 How to Verify

Check if Vulnerable:

Check Version:

Verify Fix Applied:

📡 Detection & Monitoring

Log Indicators:

Network Indicators:

SIEM Query:

📊 Metadata

🔗 References

📤 Share & Export

🔗 Related Vulnerabilities