CVE-2022-1048: 
Linux Kernel vulnerability analysis and mitigation

A use-after-free vulnerability (CVE-2022-1048) was discovered in the Linux kernel's sound subsystem, specifically in the way a user triggers concurrent calls of PCM hwparams and hwfree ioctls. The vulnerability was discovered by Hu Jiahui and affects Linux kernel versions through 5.17:rc8. The flaw exists in the Advanced Linux Sound Architecture (ALSA) PCM framework (Ubuntu Security).

The vulnerability stems from a race condition in the sound subsystem where concurrent calls to PCM hwparams and hwfree ioctls can lead to a use-after-free condition. The issue occurs because the current ALSA PCM core doesn't properly protect against concurrent ioctl calls. The vulnerability has been assigned a CVSS v3.1 base score of 7.0 (HIGH) with the vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H (NVD).

When successfully exploited, this vulnerability allows a local user with access to a PCM sound device to crash the system or potentially escalate their privileges. The flaw enables an attacker to cause a denial of service through system crash or memory corruption, with the possibility of achieving privilege escalation (Debian Security).

The vulnerability has been fixed in Linux kernel version 5.17-rc9. Various distributions have released patches for their respective kernel versions. For example, Debian has addressed this in version 5.10.113-1 for the stable distribution (bullseye), and version 4.19.249-2 for the oldstable distribution (buster) (Debian Security, Debian Security).