CVE-2022-49248 (GCVE-0-2022-49248)
Vulnerability from cvelistv5
Published
2025-02-26 01:56
Modified
2025-05-04 08:33
Severity ?
Summary
In the Linux kernel, the following vulnerability has been resolved: ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction AV/C deferred transaction was supported at a commit 00a7bb81c20f ("ALSA: firewire-lib: Add support for deferred transaction") while 'deferrable' flag can be uninitialized for non-control/notify AV/C transactions. UBSAN reports it: kernel: ================================================================================ kernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9 kernel: load of value 158 is not a valid value for type '_Bool' kernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P OE 5.15.0-18-generic #18-Ubuntu kernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019 kernel: Call Trace: kernel: <IRQ> kernel: show_stack+0x52/0x58 kernel: dump_stack_lvl+0x4a/0x5f kernel: dump_stack+0x10/0x12 kernel: ubsan_epilogue+0x9/0x45 kernel: __ubsan_handle_load_invalid_value.cold+0x44/0x49 kernel: fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib] kernel: fcp_response+0x28/0x30 [snd_firewire_lib] kernel: fw_core_handle_request+0x230/0x3d0 [firewire_core] kernel: handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? handle_ar_packet+0x1d9/0x200 [firewire_ohci] kernel: ? transmit_complete_callback+0x9f/0x120 [firewire_core] kernel: ar_context_tasklet+0xa8/0x2e0 [firewire_ohci] kernel: tasklet_action_common.constprop.0+0xea/0xf0 kernel: tasklet_action+0x22/0x30 kernel: __do_softirq+0xd9/0x2e3 kernel: ? irq_finalize_oneshot.part.0+0xf0/0xf0 kernel: do_softirq+0x75/0xa0 kernel: </IRQ> kernel: <TASK> kernel: __local_bh_enable_ip+0x50/0x60 kernel: irq_forced_thread_fn+0x7e/0x90 kernel: irq_thread+0xba/0x190 kernel: ? irq_thread_fn+0x60/0x60 kernel: kthread+0x11e/0x140 kernel: ? irq_thread_check_affinity+0xf0/0xf0 kernel: ? set_kthread_struct+0x50/0x50 kernel: ret_from_fork+0x22/0x30 kernel: </TASK> kernel: ================================================================================ This commit fixes the bug. The bug has no disadvantage for the non- control/notify AV/C transactions since the flag has an effect for AV/C response with INTERIM (0x0f) status which is not used for the transactions in AV/C general specification.
References
https://git.kernel.org/stable/c/99582e4b19f367fa95bdd150b3034d7ce8113342
https://git.kernel.org/stable/c/b2b65c9013dc28836d82e25d0f0c94d794a14aba
https://git.kernel.org/stable/c/60e5d391805d70458a01998de00d0c28cba40bf3
https://git.kernel.org/stable/c/7025f40690a235a118c87674cfb93072694aa66d
https://git.kernel.org/stable/c/7e6f5786621df060f8296f074efd275eaf20361a
https://git.kernel.org/stable/c/eab74c41612083bd627b60da650e19234e4f1051
https://git.kernel.org/stable/c/d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e
https://git.kernel.org/stable/c/39d2c4a33dc1b4402cec68a3c8f82c6588b6edce
https://git.kernel.org/stable/c/bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d
Impacted products
Vendor Product Version
Linux Linux Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
Version: 00a7bb81c20f3e81711e28e0f6c08cee8fd18514
 Create a notification for this product.
   Linux Linux Version: 3.16
 Create a notification for this product.
Show details on NVD website

To clipboard 

{
  "containers": {
    "cna": {
      "affected": [
        {
          "defaultStatus": "unaffected",
          "product": "Linux",
          "programFiles": [
            "sound/firewire/fcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "lessThan": "99582e4b19f367fa95bdd150b3034d7ce8113342",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "b2b65c9013dc28836d82e25d0f0c94d794a14aba",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "60e5d391805d70458a01998de00d0c28cba40bf3",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "7025f40690a235a118c87674cfb93072694aa66d",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "7e6f5786621df060f8296f074efd275eaf20361a",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "eab74c41612083bd627b60da650e19234e4f1051",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "39d2c4a33dc1b4402cec68a3c8f82c6588b6edce",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            },
            {
              "lessThan": "bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d",
              "status": "affected",
              "version": "00a7bb81c20f3e81711e28e0f6c08cee8fd18514",
              "versionType": "git"
            }
          ]
        },
        {
          "defaultStatus": "affected",
          "product": "Linux",
          "programFiles": [
            "sound/firewire/fcp.c"
          ],
          "repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
          "vendor": "Linux",
          "versions": [
            {
              "status": "affected",
              "version": "3.16"
            },
            {
              "lessThan": "3.16",
              "status": "unaffected",
              "version": "0",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.9.*",
              "status": "unaffected",
              "version": "4.9.311",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.14.*",
              "status": "unaffected",
              "version": "4.14.276",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "4.19.*",
              "status": "unaffected",
              "version": "4.19.238",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.4.*",
              "status": "unaffected",
              "version": "5.4.189",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.10.*",
              "status": "unaffected",
              "version": "5.10.110",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.15.*",
              "status": "unaffected",
              "version": "5.15.33",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.16.*",
              "status": "unaffected",
              "version": "5.16.19",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "5.17.*",
              "status": "unaffected",
              "version": "5.17.2",
              "versionType": "semver"
            },
            {
              "lessThanOrEqual": "*",
              "status": "unaffected",
              "version": "5.18",
              "versionType": "original_commit_for_fix"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.9.311",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.14.276",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "4.19.238",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.4.189",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.10.110",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.15.33",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.16.19",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.17.2",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "5.18",
                  "versionStartIncluding": "3.16",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction\n\nAV/C deferred transaction was supported at a commit 00a7bb81c20f (\"ALSA:\nfirewire-lib: Add support for deferred transaction\") while \u0027deferrable\u0027\nflag can be uninitialized for non-control/notify AV/C transactions.\nUBSAN reports it:\n\nkernel: ================================================================================\nkernel: UBSAN: invalid-load in /build/linux-aa0B4d/linux-5.15.0/sound/firewire/fcp.c:363:9\nkernel: load of value 158 is not a valid value for type \u0027_Bool\u0027\nkernel: CPU: 3 PID: 182227 Comm: irq/35-firewire Tainted: P           OE     5.15.0-18-generic #18-Ubuntu\nkernel: Hardware name: Gigabyte Technology Co., Ltd. AX370-Gaming 5/AX370-Gaming 5, BIOS F42b 08/01/2019\nkernel: Call Trace:\nkernel:  \u003cIRQ\u003e\nkernel:  show_stack+0x52/0x58\nkernel:  dump_stack_lvl+0x4a/0x5f\nkernel:  dump_stack+0x10/0x12\nkernel:  ubsan_epilogue+0x9/0x45\nkernel:  __ubsan_handle_load_invalid_value.cold+0x44/0x49\nkernel:  fcp_response.part.0.cold+0x1a/0x2b [snd_firewire_lib]\nkernel:  fcp_response+0x28/0x30 [snd_firewire_lib]\nkernel:  fw_core_handle_request+0x230/0x3d0 [firewire_core]\nkernel:  handle_ar_packet+0x1d9/0x200 [firewire_ohci]\nkernel:  ? handle_ar_packet+0x1d9/0x200 [firewire_ohci]\nkernel:  ? transmit_complete_callback+0x9f/0x120 [firewire_core]\nkernel:  ar_context_tasklet+0xa8/0x2e0 [firewire_ohci]\nkernel:  tasklet_action_common.constprop.0+0xea/0xf0\nkernel:  tasklet_action+0x22/0x30\nkernel:  __do_softirq+0xd9/0x2e3\nkernel:  ? irq_finalize_oneshot.part.0+0xf0/0xf0\nkernel:  do_softirq+0x75/0xa0\nkernel:  \u003c/IRQ\u003e\nkernel:  \u003cTASK\u003e\nkernel:  __local_bh_enable_ip+0x50/0x60\nkernel:  irq_forced_thread_fn+0x7e/0x90\nkernel:  irq_thread+0xba/0x190\nkernel:  ? irq_thread_fn+0x60/0x60\nkernel:  kthread+0x11e/0x140\nkernel:  ? irq_thread_check_affinity+0xf0/0xf0\nkernel:  ? set_kthread_struct+0x50/0x50\nkernel:  ret_from_fork+0x22/0x30\nkernel:  \u003c/TASK\u003e\nkernel: ================================================================================\n\nThis commit fixes the bug. The bug has no disadvantage for the non-\ncontrol/notify AV/C transactions since the flag has an effect for AV/C\nresponse with INTERIM (0x0f) status which is not used for the transactions\nin AV/C general specification."
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-05-04T08:33:19.120Z",
        "orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
        "shortName": "Linux"
      },
      "references": [
        {
          "url": "https://git.kernel.org/stable/c/99582e4b19f367fa95bdd150b3034d7ce8113342"
        },
        {
          "url": "https://git.kernel.org/stable/c/b2b65c9013dc28836d82e25d0f0c94d794a14aba"
        },
        {
          "url": "https://git.kernel.org/stable/c/60e5d391805d70458a01998de00d0c28cba40bf3"
        },
        {
          "url": "https://git.kernel.org/stable/c/7025f40690a235a118c87674cfb93072694aa66d"
        },
        {
          "url": "https://git.kernel.org/stable/c/7e6f5786621df060f8296f074efd275eaf20361a"
        },
        {
          "url": "https://git.kernel.org/stable/c/eab74c41612083bd627b60da650e19234e4f1051"
        },
        {
          "url": "https://git.kernel.org/stable/c/d07e4bbaff6fbba6f70c04b092ea7d9afcdf392e"
        },
        {
          "url": "https://git.kernel.org/stable/c/39d2c4a33dc1b4402cec68a3c8f82c6588b6edce"
        },
        {
          "url": "https://git.kernel.org/stable/c/bf0cd60b7e33cf221fbe1114e4acb2c828b0af0d"
        }
      ],
      "title": "ALSA: firewire-lib: fix uninitialized flag for AV/C deferred transaction",
      "x_generator": {
        "engine": "bippy-1.2.0"
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
    "assignerShortName": "Linux",
    "cveId": "CVE-2022-49248",
    "datePublished": "2025-02-26T01:56:06.709Z",
    "dateReserved": "2025-02-26T01:49:39.295Z",
    "dateUpdated": "2025-05-04T08:33:19.120Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.