ALSA: oss: Fix PCM OSS buffer allocation overflow

Kernel Updated 02 Oct 2025

Summary

24/04/2022

Disclosed on

N/A

Severity

No i

Fix available

Unrated

Severity

Not published

CVSS Score

GSD-2022-1002152: ALSA: oss: Fix PCM OSS buffer allocation overflow. Affects Kernel versions < 5ce74ff7059341d8b2f4d01c3383491df63d1898. No fix is published. How to fix ↓

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The ALSA (Advanced Linux Sound Architecture) is a software framework and part of the Linux kernel that provides an API for sound card device drivers. It enables audio and MIDI functionality on Linux-based systems. The PCM OSS (Open Sound System) is a component of ALSA that allows applications to access the sound card directly.

The vulnerability identified in the PCM OSS buffer allocation can lead to an overflow. This vulnerability could potentially be exploited by an attacker to execute arbitrary code or cause a denial-of-service (DoS) condition on a vulnerable system.

Vulnerability Detail

The vulnerability in the PCM OSS buffer allocation occurs due to improper handling of buffer size calculations. An attacker could craft a malicious request that triggers an overflow when allocating memory for the PCM OSS buffer. This overflow can result in memory corruption, leading to various security issues.

The impact of this vulnerability includes the possibility of remote code execution, privilege escalation, or system crashes. Successful exploitation of this vulnerability could allow an attacker to gain unauthorized access to the affected system or disrupt its normal operation.

The vulnerability has been fixed in the Linux Kernel version v5.10.109 by commit 5ce74ff7059341d8b2f4d01c3383491df63d1898.

How To Fix

No fixed version is published for this vulnerability.

To fix this vulnerability, it is recommended to update the Linux Kernel to version v5.10.109 or later. This update includes the necessary patch to address the buffer allocation overflow in the PCM OSS component of ALSA. Users should ensure they are running a version of the Linux Kernel that includes the fix.

Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →

Workaround

If updating the Linux Kernel is not immediately feasible, a possible workaround is to disable the PCM OSS component of ALSA. This can be achieved by modifying the system's configuration files or using kernel boot parameters to exclude the PCM OSS module from loading. However, disabling PCM OSS may impact the functionality of applications that rely on it.

Conclusion

The vulnerability in the PCM OSS buffer allocation poses a significant risk to systems running the affected Linux Kernel versions. It is crucial to update to the fixed version or apply the provided workaround to mitigate the vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for Kernel →