In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls. This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved into the state-check block) for code simplicity.

The remote SUSE Linux SLES15 / SLES_SAP15 host has packages installed that are affected by multiple vulnerabilities as referenced in the SUSE-SU-2025:1027-1 advisory.

    The SUSE Linux Enterprise 15 SP4 kernel was updated to receive various security bugfixes.


    The following security bugs were fixed:

    - CVE-2024-2201: Fixed information leak in x86/BHI (bsc#1217339).
    - CVE-2024-41092: drm/i915/gt: Fix potential UAF by revoke of fence registers (bsc#1228483).
    - CVE-2024-42098: crypto: ecdh - explicitly zeroize private_key (bsc#1228779).
    - CVE-2024-42229: crypto: aead,cipher - zeroize key buffer after use (bsc#1228708).
    - CVE-2024-57996: net_sched: sch_sfq: do not allow 1 packet limit (bsc#1239076).
    - CVE-2024-58014: wifi: brcmsmac: add gain range check to wlc_phy_iqcal_gainparams_nphy() (bsc#1239109).
    - CVE-2025-21718: net: rose: fix timer races against user threads (bsc#1239073).
    - CVE-2025-21780: drm/amdgpu: avoid buffer overflow attach in smu_sys_set_pp_table() (bsc#1239115).


Tenable has extracted the preceding description block directly from the SUSE security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In the Linux kernel, the following vulnerability has been resolved: ALSA: pcm: Fix races among concurrent     hw_params and hw_free calls Currently we have neither proper check nor protection against the concurrent     calls of PCM hw_params and hw_free ioctls, which may result in a UAF. Since the existing PCM stream lock     can't be used for protecting the whole ioctl operations, we need a new mutex to protect those racy calls.
    This patch introduced a new mutex, runtime->buffer_mutex, and applies it to both hw_params and hw_free     ioctl code paths. Along with it, the both functions are slightly modified (the mmap_count check is moved     into the state-check block) for code simplicity. (CVE-2022-49291)

Note that Nessus relies on the presence of the package as reported by the vendor.

The version of kernel installed on the remote host is prior to 5.4.196-108.356. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.4-2022-026 advisory.

    A kernel information leak flaw was identified in the scsi_ioctl function in drivers/scsi/scsi_ioctl.c in     the Linux kernel. This flaw allows a local attacker with a special user privilege (CAP_SYS_ADMIN or     CAP_SYS_RAWIO) to create issues with confidentiality. (CVE-2022-0494)

    A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

    perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)

    floppy: disable FDRAWCMD by default (CVE-2022-1836)

    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

    The SUNRPC subsystem in the Linux kernel through 5.17.2 can call xs_xprt_free before ensuring that sockets     are in the intended state. (CVE-2022-28893)

    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (CVE-2022-49291)

    A use-after-free flaw was found in vhost_net_set_backend in drivers/vhost/net.c in virtio network     subcomponent in the Linux kernel due to a double fget. This flaw could allow a local attacker to crash the     system, and could even lead to a kernel information leak problem. (CVE-2023-1838)

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 4.14.281-212.502. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2-2022-1798 advisory.

    A memory leak flaw was found in the Linux kernel's DMA subsystem, in the way a user calls DMA_FROM_DEVICE.
    This flaw allows a local user to read random memory from the kernel space. (CVE-2022-0854)

    perf: Fix sys_perf_event_open() race against self (CVE-2022-1729)

    An integer coercion error was found in the openvswitch kernel module. Given a sufficiently large number of     actions, while copying and reserving memory for a new action of a new flow, the reserve_sfa_size()     function does not return -EMSGSIZE as expected, potentially leading to an out-of-bounds write access. This     flaw allows a local user to crash or potentially escalate their privileges on the system. (CVE-2022-2639)

    Improper Update of Reference Count vulnerability in net/sched of Linux Kernel allows local attacker to     cause privilege escalation to root. This issue affects: Linux Kernel versions prior to 5.18; version 4.14     and later versions. (CVE-2022-29581)

    The Linux kernel before 5.17.2 mishandles seccomp permissions. The PTRACE_SEIZE code path allows attackers     to bypass intended restrictions on setting the PT_SUSPEND_SECCOMP flag. (CVE-2022-30594)

    An issue was discovered in drivers/input/input.c in the Linux kernel before 5.17.10. An attacker can cause     a denial of service (panic) because input_set_capability mishandles the situation in which an event code     falls outside of a bitmap. (CVE-2022-48619)

    In the Linux kernel, the following vulnerability has been resolved:

    swiotlb: fix info leak with DMA_FROM_DEVICE (CVE-2022-48853)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (CVE-2022-49291)

    A use-after-free flaw was found in vmxnet3_rq_alloc_rx_buf in drivers/net/vmxnet3/vmxnet3_drv.c in     VMware's vmxnet3 ethernet NIC driver in the Linux Kernel. This issue could allow a local attacker to crash     the system due to a double-free while cleaning up vmxnet3_rq_cleanup_all, which could also lead to a     kernel information leak problem. (CVE-2023-4387)

    A NULL pointer dereference flaw was found in vmxnet3_rq_cleanup in drivers/net/vmxnet3/vmxnet3_drv.c in     the networking sub-component in vmxnet3 in the Linux Kernel. This issue may allow a local attacker with     normal user privilege to cause a denial of service due to a missing sanity check during cleanup.
    (CVE-2023-4459)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The version of kernel installed on the remote host is prior to 5.10.109-104.500. It is, therefore, affected by multiple vulnerabilities as referenced in the ALAS2KERNEL-5.10-2022-013 advisory.

    A use-after-free flaw was found in the Linux kernel's sound subsystem in the way a user triggers     concurrent calls of PCM hw_params. The hw_free ioctls or similar race condition happens inside ALSA PCM     for other ioctls. This flaw allows a local user to crash or potentially escalate their privileges on the     system. (CVE-2022-1048)

    Product: AndroidVersions: Android kernelAndroid ID: A-224546354References: Upstream kernel     (CVE-2022-20368)

    A buffer overflow flaw was found in the Linux kernel's NFC protocol functionality. This flaw allows a     local user to crash or escalate their privileges on the system. (CVE-2022-26490)

    In the Linux kernel before 5.17.1, a refcount leak bug was found in net/llc/af_llc.c. (CVE-2022-28356)

    In the Linux kernel, the following vulnerability has been resolved:

    usb: usbtmc: Fix bug in pipe direction for control transfers (CVE-2022-48834)

    In the Linux kernel, the following vulnerability has been resolved:

    net/packet: fix slab-out-of-bounds access in packet_recvmsg() (CVE-2022-48839)

    In the Linux kernel, the following vulnerability has been resolved:

    drm/vrr: Set VRR capable prop only if it is attached to connector (CVE-2022-48843)

    In the Linux kernel, the following vulnerability has been resolved:

    tpm: use try_get_ops() in tpm-space.c (CVE-2022-49286)

    In the Linux kernel, the following vulnerability has been resolved:

    ALSA: pcm: Fix races among concurrent hw_params and hw_free calls (CVE-2022-49291)

Tenable has extracted the preceding description block directly from the tested product security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
233410	SUSE SLES15 Security Update : kernel (SUSE-SU-2025:1027-1)	Nessus	SuSE Local Security Checks	high
225512	Linux Distros Unpatched Vulnerability : CVE-2022-49291	Nessus	Misc.	high
162005	Amazon Linux 2 : kernel (ALASKERNEL-5.4-2022-026)	Nessus	Amazon Linux Local Security Checks	high
161935	Amazon Linux 2 : kernel (ALAS-2022-1798)	Nessus	Amazon Linux Local Security Checks	high
160426	Amazon Linux 2 : kernel (ALASKERNEL-5.10-2022-013)	Nessus	Amazon Linux Local Security Checks	high

Detections

Analytics

CVE-2022-49291

high

Tenable Plugins

high

high

high

high

high