Detections
Analytics
Linux Distros Unpatched Vulnerability : CVE-2022-48735
high Nessus Plugin ID 225563
Synopsis
The Linux/Unix host has one or more packages installed with a vulnerability that the vendor indicates will not be patched.Description
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.- In the Linux kernel, the following vulnerability has been resolved: ALSA: hda: Fix UAF of leds class devs at unbinding The LED class devices that are created by HD-audio codec drivers are registered via devm_led_classdev_register() and associated with the HD-audio codec device. Unfortunately, it turned out that the devres release doesn't work for this case; namely, since the codec resource release happens before the devm call chain, it triggers a NULL dereference or a UAF for a stale set_brightness_delay callback. For fixing the bug, this patch changes the LED class device register and unregister in a manual manner without devres, keeping the instances in hda_gen_spec. (CVE-2022-48735)
Note that Nessus relies on the presence of the package as reported by the vendor.
Solution
There is no known solution at this time.Plugin Details
Severity: High
ID: 225563
File Name: unpatched_CVE_2022_48735.nasl
Version: 1.1
Type: local
Agent: unix
Family: Misc.
Published: 3/5/2025
Updated: 3/5/2025
Supported Sensors: Nessus Agent, Nessus
Risk Information
VPR
Risk Factor: Medium
Score: 6.7
CVSS v2
Risk Factor: Medium
Base Score: 6.8
Temporal Score: 5
Vector: CVSS2#AV:L/AC:L/Au:S/C:C/I:C/A:C
CVSS Score Source: CVE-2022-48735
CVSS v3
Risk Factor: High
Base Score: 7.8
Temporal Score: 6.8
Vector: CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Temporal Vector: CVSS:3.0/E:U/RL:O/RC:C
Vulnerability Information
Required KB Items: Host/cpu, Host/local_checks_enabled, global_settings/vendor_unpatched
Exploit Ease: No known exploits are available
Vulnerability Publication Date: 6/20/2024
Reference Information
CVE: CVE-2022-48735