Vulnerability Description
An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a specially crafted name through ioctl() interface and crash the system or potentially escalate their privileges on the system.
CVSS Score
HIGH
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Linux | Linux Kernel | 6.0 |
Related Weaknesses (CWE)
References
- https://github.com/torvalds/linux/commit/5934d9a0383619c14df91af8fd76261dc3de2f5PatchThird Party Advisory
- https://github.com/torvalds/linux/commit/6ab55ec0a938c7f943a4edba3d6514f77598388PatchThird Party Advisory
- https://github.com/torvalds/linux/commit/5934d9a0383619c14df91af8fd76261dc3de2f5PatchThird Party Advisory
- https://github.com/torvalds/linux/commit/6ab55ec0a938c7f943a4edba3d6514f77598388PatchThird Party Advisory
FAQ
What is CVE-2022-3170?
CVE-2022-3170 is a vulnerability with a CVSS score of 7.8 (HIGH). An out-of-bounds access issue was found in the Linux kernel sound subsystem. It could occur when the 'id->name' provided by the user did not end with '\0'. A privileged local user could pass a special...
How severe is CVE-2022-3170?
CVE-2022-3170 has been rated HIGH with a CVSS base score of 7.8/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2022-3170?
Check the references section above for vendor advisories and patch information. Affected products include: Linux Linux Kernel.