Buffer overflow in Linux kernel usb



| Updated: 2025-05-10
Risk Low
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2022-49772
CWE-ID CWE-119
Exploitation vector Local
Public exploit N/A
Vulnerable software
 Linux kernel
Operating systems & Components / Operating system

Vendor Linux Foundation

Security Bulletin

This security bulletin contains one low risk vulnerability.

1) Buffer overflow

EUVDB-ID: #VU108384

Risk: Low

CVSSv4.0: 4.3 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2022-49772

CWE-ID: CWE-119 - Memory corruption

Exploit availability: No

Description

The vulnerability allows a local user to perform a denial of service (DoS) attack.

The vulnerability exists due to memory corruption within the snd_usbmidi_output_open() function in sound/usb/midi.c. A local user can perform a denial of service (DoS) attack.

Mitigation

Install update from vendor's website.

Vulnerable software versions

Linux kernel: 5.4 - 5.4.224

CPE2.3 External links

https://git.kernel.org/stable/c/00f5f1bbf815a39e9eecb468d12ca55d3360eb10
https://git.kernel.org/stable/c/02b94885b2fdf1808b1874e009bfb90753f8f4db
https://git.kernel.org/stable/c/368a01e5064c13946d032ab1d65ba95020a39cc5
https://git.kernel.org/stable/c/872c9314769e89d8bda74ff3ac584756a45ee752
https://git.kernel.org/stable/c/a80369c8ca50bc885d14386087a834659ec54a54
https://git.kernel.org/stable/c/ad72c3c3f6eb81d2cb189ec71e888316adada5df
https://git.kernel.org/stable/c/c43991065f36f7628cd124e037b8750c4617a7a7
https://git.kernel.org/stable/c/e7dc436aea80308a9268e6d2d85f910ff107de9b
https://mirrors.edge.kernel.org/pub/linux/kernel/v5.x/ChangeLog-5.4.225


Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###