319 lines
16 KiB
JSON
319 lines
16 KiB
JSON
{
|
|
"dataType": "CVE_RECORD",
|
|
"dataVersion": "5.2",
|
|
"cveMetadata": {
|
|
"cveId": "CVE-2022-50719",
|
|
"assignerOrgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"state": "PUBLISHED",
|
|
"assignerShortName": "Linux",
|
|
"dateReserved": "2025-12-24T12:20:40.329Z",
|
|
"datePublished": "2025-12-24T12:22:42.697Z",
|
|
"dateUpdated": "2026-10-15T21:41:23.334Z"
|
|
},
|
|
"containers": {
|
|
"cna": {
|
|
"providerMetadata": {
|
|
"orgId": "416baaa9-dc9f-4396-8d5f-8c081fb06d67",
|
|
"shortName": "Linux",
|
|
"dateUpdated": "2026-08-05T08:59:28.963Z"
|
|
},
|
|
"descriptions": [
|
|
{
|
|
"lang": "en",
|
|
"value": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: line6: fix stack overflow in line6_midi_transmit\n\nCorrectly calculate available space including the size of the chunk\nbuffer. This fixes a buffer overflow when multiple MIDI sysex\nmessages are sent to a PODxt device."
|
|
}
|
|
],
|
|
"metrics": [
|
|
{
|
|
"cvssV3_1": {
|
|
"version": "3.1",
|
|
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
|
|
"baseScore": 7.8,
|
|
"baseSeverity": "HIGH"
|
|
},
|
|
"scenarios": [
|
|
{
|
|
"lang": "en",
|
|
"value": "AV:L - Reached by writing MIDI/sysex to the local ALSA rawmidi node (/dev/snd/midiC*D*) once a Line 6 CONTROL_MIDI device is bound; presence of the device is an environmental precondition, not a physical attack vector (same model as CVE-2024-44954).\nAC:L - An unprivileged local user can deterministically overflow the 16-byte stack chunk by sending MIDI data whenever max_packet_size exceeds LINE6_FALLBACK_MAXPACKETSIZE (as on a real PODxt); no race or uncontrollable layout is required.\nPR:L - Only ordinary access to the ALSA rawmidi character device is needed, which desktop/session users get via udev ACLs or audio group membership; no CAP_SYS_ADMIN or root is required.\nUI:N - The attacker opens the rawmidi node and writes the overflowing MIDI payload themselves; no separate victim action such as mounting a filesystem is required.\nS:U - Stack corruption and any resulting privilege escalation remain within the host kernel's security authority; this is not a VM escape or IOMMU/DMA boundary bypass.\nC:H - Attacker-controlled stack overflow is memory corruption that can be leveraged for information disclosure (e.g., via corrupted stack frames or subsequent primitives), so Confidentiality is High per OOB-write guidance.\nI:H - The out-of-bounds write into the stack chunk with attacker-controlled MIDI bytes can overwrite return addresses and locals, yielding a control-flow hijack / arbitrary-write primitive.\nA:H - Stack buffer overflow reliably corrupts kernel stack state and can oops/panic the kernel even when not fully weaponized, so Availability is High."
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"affected": [
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "unaffected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"sound/usb/line6/midi.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "b026af92b2cea907c780f7168c730c816cd33311",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "49cb7737e733013ec86aa77ed2e19b94a68eaa05",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "0c76087449ee4ed45a88b10017d02c6694caedb1",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "25e8c6ecb46843a955f254b8f0d77894e4a53dc4",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "66f359ad66d49f75d39ac729f9114dabf90b81bb",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "0c9118e381ff538874e00fd4e66a768273c150fb",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "61e4be4a60cc6de723f8c574ddbcb3025eb44cac",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "389d34c2a8b52acc351fd932ed4bea41fee5a39b",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
},
|
|
{
|
|
"version": "f2459201c72e8f8553644505eed19954d4c3a023",
|
|
"lessThan": "b8800d324abb50160560c636bfafe2c81001b66c",
|
|
"status": "affected",
|
|
"versionType": "git"
|
|
}
|
|
]
|
|
},
|
|
{
|
|
"product": "Linux",
|
|
"vendor": "Linux",
|
|
"defaultStatus": "affected",
|
|
"repo": "https://git.kernel.org/pub/scm/linux/kernel/git/stable/linux.git",
|
|
"programFiles": [
|
|
"sound/usb/line6/midi.c"
|
|
],
|
|
"versions": [
|
|
{
|
|
"version": "3.15",
|
|
"status": "affected"
|
|
},
|
|
{
|
|
"version": "0",
|
|
"lessThan": "3.15",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.9.337",
|
|
"lessThanOrEqual": "4.9.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.14.303",
|
|
"lessThanOrEqual": "4.14.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "4.19.270",
|
|
"lessThanOrEqual": "4.19.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.4.229",
|
|
"lessThanOrEqual": "5.4.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.10.163",
|
|
"lessThanOrEqual": "5.10.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "5.15.87",
|
|
"lessThanOrEqual": "5.15.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.0.17",
|
|
"lessThanOrEqual": "6.0.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.1.3",
|
|
"lessThanOrEqual": "6.1.*",
|
|
"status": "unaffected",
|
|
"versionType": "semver"
|
|
},
|
|
{
|
|
"version": "6.2",
|
|
"lessThanOrEqual": "*",
|
|
"status": "unaffected",
|
|
"versionType": "original_commit_for_fix"
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"cpeApplicability": [
|
|
{
|
|
"nodes": [
|
|
{
|
|
"operator": "OR",
|
|
"negate": false,
|
|
"cpeMatch": [
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "4.9.337"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "4.14.303"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "4.19.270"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "5.4.229"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "5.10.163"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "5.15.87"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "6.0.17"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "6.1.3"
|
|
},
|
|
{
|
|
"vulnerable": true,
|
|
"criteria": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*",
|
|
"versionStartIncluding": "3.15",
|
|
"versionEndExcluding": "6.2"
|
|
}
|
|
]
|
|
}
|
|
]
|
|
}
|
|
],
|
|
"references": [
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b026af92b2cea907c780f7168c730c816cd33311"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/49cb7737e733013ec86aa77ed2e19b94a68eaa05"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0c76087449ee4ed45a88b10017d02c6694caedb1"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/25e8c6ecb46843a955f254b8f0d77894e4a53dc4"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/66f359ad66d49f75d39ac729f9114dabf90b81bb"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/0c9118e381ff538874e00fd4e66a768273c150fb"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/61e4be4a60cc6de723f8c574ddbcb3025eb44cac"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/389d34c2a8b52acc351fd932ed4bea41fee5a39b"
|
|
},
|
|
{
|
|
"url": "https://git.kernel.org/stable/c/b8800d324abb50160560c636bfafe2c81001b66c"
|
|
}
|
|
],
|
|
"title": "ALSA: line6: fix stack overflow in line6_midi_transmit",
|
|
"x_generator": {
|
|
"engine": "bippy-1.2.0"
|
|
}
|
|
},
|
|
"adp": [
|
|
{
|
|
"metrics": [
|
|
{
|
|
"other": {
|
|
"type": "ssvc",
|
|
"content": {
|
|
"id": "CVE-2022-50719",
|
|
"role": "CISA Coordinator",
|
|
"options": [
|
|
{
|
|
"Exploitation": "none"
|
|
},
|
|
{
|
|
"Automatable": "no"
|
|
},
|
|
{
|
|
"Technical Impact": "total"
|
|
}
|
|
],
|
|
"version": "2.0.3",
|
|
"timestamp": "2026-10-15T21:32:16.726459Z"
|
|
}
|
|
}
|
|
}
|
|
],
|
|
"title": "CISA ADP Vulnrichment",
|
|
"providerMetadata": {
|
|
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
|
|
"shortName": "CISA-ADP",
|
|
"dateUpdated": "2026-10-15T21:41:23.334Z"
|
|
}
|
|
}
|
|
]
|
|
}
|
|
} |