Analyst readout for executives and security teams
Plain-English summary
CVE-2022-49733 is a Linux kernel ALSA OSS audio compatibility bug. A local, low-privileged user could trigger a race during audio sync handling, potentially crashing the system. It is not remotely reachable, requires timing, and the bundle does not show known active exploitation.
Executive priority
Treat as a moderate availability risk. It is not a remote compromise path, but a local crash primitive can still matter on shared Linux hosts, developer workstations, and multi-tenant workload environments.
Technical view
The flaw is a race in snd_pcm_oss_sync() for the SNDCTL_DSP_SYNC ioctl. snd_pcm_oss_make_ready() ran before params_lock, allowing another thread to reconfigure the stream and create inconsistent state, including possible NULL dereference of the OSS buffer. The fix moves readiness handling under the same mutex.
Likely exposure
Exposure is mainly Linux systems with vulnerable kernels and ALSA OSS PCM compatibility reachable by local users or local workloads. Systems without local untrusted users are lower risk. Distribution-specific package status must be verified separately.
Exploitation context
The CVSS vector is local, high complexity, low privilege, no user interaction, with high availability impact. The source bundle says a fuzzer observed the issue. KEV is false, and no cited source states active exploitation.
Researcher notes
Evidence supports a concurrency bug fixed by locking around OSS PCM readiness handling. Affected version data in the bundle is sparse and commit-oriented, so exact exposure should be resolved through distro kernel advisories or kernel stable backport mapping.
Mitigation direction
- Apply vendor Linux kernel updates containing the referenced stable fixes.
- Verify distribution advisories for exact fixed package versions.
- Restrict local shell or workload access on shared systems where patching is delayed.
- Monitor kernel crash logs for ALSA OSS PCM NULL dereference indicators.
Validation and detection
- Inventory Linux kernel versions across servers, workstations, and appliances.
- Confirm whether ALSA OSS PCM compatibility is present and reachable locally.
- Map installed kernels against vendor advisories and stable commit backports.
- Prioritize shared multi-user systems and hosts running untrusted local workloads.
Public sources used
Based on public source material and reviewed before publication.
Conservative CVE-to-ATT&CK context
These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.
ATT&CK lookup starting points
Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.
CWE-476: Exact CWE lookup
Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.
Open ATT&CK lookupCVE-2022-49733 mapping review
Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.
Open ATT&CK lookup- Severity
- Medium
- CVSS
- 4.7 (3.1)
- Known Exploited
- No
- Published
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
CNA and ADP enrichment extracted from CVE v5
These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.
SSVC decision data
CVSS vector scores
1 official scoreWe collect every scored CVSS vector available in the official CNA and ADP containers. When more than one version is present, the table keeps the source vectors side by side instead of collapsing them into the highest score.
CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H13.6CISA-ADPVulnerability scoring details
Base CVSS 3.1 score
4.7MediumVector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:H
Vulnerability timeline
Timeline events are normalized from CVE metadata, CNA source timelines, ADP timelines, and KEV metadata when present.
- CVE reservedCVE Program
The CVE ID was reserved by the assigning CNA.
- CVE publishedCVE Program
The CVE record was published.
- CVE updatedCVE Program
The CVE record metadata indicates this as the latest update time.
ADP provider summaries
Source materials
- CVE List V5 sourceCVE List V5
- https://git.kernel.org/stable/c/4051324a6dafd7053c74c475e80b3ba10ae672b0CVE reference, Linux
- https://git.kernel.org/stable/c/fce793a056c604b41a298317cf704dae255f1b36CVE reference, Linux
- https://git.kernel.org/stable/c/8015ef9e8a0ee5cecfd0cb6805834d007ab26f86CVE reference, Linux
- https://git.kernel.org/stable/c/723ac5ab2891b6c10dd6cc78ef5456af593490ebCVE reference, Linux
- https://git.kernel.org/stable/c/8423f0b6d513b259fdab9c9bf4aaa6188d054c2dCVE reference, Linux
Products and packages named in the record
CWE details
CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.
NULL Pointer Dereference
NULL Pointer Dereference represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.