CVE-2022-48701

What it actually does

Out-of-bounds read in __snd_usb_parse_audio_interface() when a USB audio device reports fewer than four interfaces, allowing kernel memory access beyond the interface descriptor array.

Why it matters to the business

Systems using USB audio hardware may experience kernel crashes, denial of service, or limited information disclosure when an attacker-supplied or malformed device is connected; patch urgency remains low due to the absence of known exploitation and limited EPSS score.

How an attack unfolds

An attacker prepares a USB audio device with a crafted descriptor claiming fewer than four interfaces, connects it to a vulnerable Linux system, and triggers the ALSA usb-audio parsing path that performs the unchecked out-of-bounds read.

How to fix it

Upgrade the Linux kernel to a version containing commit b970518014f2f0f6c493fb86c1e092b936899061 or later; rebuild and reboot with the patched kernel image.

How to confirm the fix worked

Verify the running kernel contains commit b970518014f2f0f6c493fb86c1e092b936899061 via git log or uname output against the fixed stable tree; confirm the bounds check exists in __snd_usb_parse_audio_interface().

Typical attack path

1. Prepare or modify a USB device to report USB ID 0x04fa:0x4201 and fewer than four interfaces
2. Connect the device to a vulnerable Linux host
3. Allow the kernel to enumerate the device and invoke snd_usb_parse_audio_interface
4. Trigger the missing bounds check during descriptor parsing to read past allocated memory

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for usb-audio oops or warning messages during device enumeration; look for references to snd_usb_parse_audio_interface and interface count anomalies.

What your security team should do

• Apply the referenced kernel commit or distribution update containing the interface count check as soon as practical
• Restrict physical or virtual USB device attachment to untrusted hardware until patched
• Monitor kernel logs for usb-audio parsing warnings or oops messages after device enumeration