{ "document": { "aggregate_severity": { "text": "High" }, "category": "csaf_vex", "csaf_version": "2.0", "distribution": { "text": "TuxCare License Agreement", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Cloud Linux Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://tuxcare.com/contact/", "name": "TuxCare", "namespace": "https://tuxcare.com/" }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://security.tuxcare.com/csaf/v2/els_os/centos7els/vex/2022/cve-2022-49292-els_os-centos7els.json" } ], "title": "Security update on CVE-2022-49292", "tracking": { "current_release_date": "2025-12-23T20:55:41Z", "generator": { "date": "2025-12-23T20:55:41Z", "engine": { "name": "pyCSAF" } }, "id": "CVE-2022-49292-ELS_OS-CENTOS7ELS", "initial_release_date": "2022-01-01T00:00:00Z", "revision_history": [ { "date": "2022-01-01T00:00:00Z", "number": "1", "summary": "Initial version" }, { "date": "2025-10-15T16:27:14Z", "number": "2", "summary": "Official Publication" }, { "date": "2025-12-23T20:55:41Z", "number": "3", "summary": "Update document" } ], "status": "final", "version": "2" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Community Enterprise Operating System 7", "product": { "name": "Community Enterprise Operating System 7", "product_id": "CentOS-7", "product_identification_helper": { "cpe": "cpe:2.3:o:centos:centos:7:*:*:*:*:*:*:*" } } } ], "category": "product_family", "name": "Community Enterprise Operating System" } ], "category": "vendor", "name": "Red Hat, Inc." }, { "branches": [ { "branches": [ { "category": "product_version", "name": "kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs-devel@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug-devel@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-debug@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/perf@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-tools-libs@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-devel@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/kernel-headers@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/python-perf@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } }, { "category": "product_version", "name": "bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product": { "name": "bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_id": "bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "product_identification_helper": { "purl": "pkg:rpm/tuxcare/bpftool@3.10.0-1160.119.1.el7.tuxcare.els25?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "TuxCare" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" }, { "category": "default_component_of", "full_product_name": { "name": "bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64 as a component of Community Enterprise Operating System 7", "product_id": "CentOS-7:bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" }, "product_reference": "bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "relates_to_product_reference": "CentOS-7" } ] }, "vulnerabilities": [ { "cve": "CVE-2022-49292", "cwe": { "id": "CWE-787", "name": "Out-of-bounds Write" }, "notes": [ { "category": "description", "text": "In the Linux kernel, the following vulnerability has been resolved:\n\nALSA: oss: Fix PCM OSS buffer allocation overflow\n\nWe've got syzbot reports hitting INT_MAX overflow at vmalloc()\nallocation that is called from snd_pcm_plug_alloc(). Although we\napply the restrictions to input parameters, it's based only on the\nhw_params of the underlying PCM device. Since the PCM OSS layer\nallocates a temporary buffer for the data conversion, the size may\nbecome unexpectedly large when more channels or higher rates is given;\nin the reported case, it went over INT_MAX, hence it hits WARN_ON().\n\nThis patch is an attempt to avoid such an overflow and an allocation\nfor too large buffers. First off, it adds the limit of 1MB as the\nupper bound for period bytes. This must be large enough for all use\ncases, and we really don't want to handle a larger temporary buffer\nthan this size. The size check is performed at two places, where the\noriginal period bytes is calculated and where the plugin buffer size\nis calculated.\n\nIn addition, the driver uses array_size() and array3_size() for\nmultiplications to catch overflows for the converted period size and\nbuffer bytes.", "title": "Vulnerability description" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "CentOS-7:bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://cve.tuxcare.com/els/cve/CVE-2022-49292" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b", "url": "https://git.kernel.org/stable/c/0c4190b41a69990666b4000999e27f8f1b2a426b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898", "url": "https://git.kernel.org/stable/c/5ce74ff7059341d8b2f4d01c3383491df63d1898" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b", "url": "https://git.kernel.org/stable/c/7a40cbf3579a8e14849ba7ce46309c1992658d2b" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5", "url": "https://git.kernel.org/stable/c/a63af1baf0a5e11827db60e3127f87e437cab6e5" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a", "url": "https://git.kernel.org/stable/c/e74a069c6a7bb505f3ade141dddf85f4b0b5145a" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366", "url": "https://git.kernel.org/stable/c/efb6402c3c4a7c26d97c92d70186424097b6e366" }, { "category": "external", "summary": "https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade", "url": "https://git.kernel.org/stable/c/fb08bf99195a87c798bc8ae1357337a981faeade" } ], "release_date": "2025-02-26T07:01:00Z", "scores": [ { "cvss_v3": { "attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "version": "3.1" }, "products": [ "CentOS-7:bpftool-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-debug-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-debug-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-headers-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-libs-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:kernel-tools-libs-devel-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64", "CentOS-7:python-perf-0:3.10.0-1160.119.1.el7.tuxcare.els25.x86_64" ] } ], "threats": [ { "category": "impact", "details": "Important" } ] } ] }