CVE-2022-31651

Vulnerability

In SoX (Sound eXchange) version 14.4.2, there is an assertion failure in the function rate_init located in rate.c in libsox.a. The assertion factor > 0 fails when processing a specially crafted audio file (e.g., an AIFF file with specific parameters), because the computed resampling factor becomes zero or negative [1][2]. This occurs in the latest commit at the time of reporting (42b3557e13e0fe01a83465b672d89faddbe65f49) [2].

Exploitation

An attacker can trigger the assertion failure by providing a malicious audio file (e.g., AIFF) to SoX and running a command like sox --single-threaded crafted.aiff /dev/null [2]. No authentication or special network position is required—only local access to create a crafted file. The vulnerability is reachable without any race window or user interaction beyond opening the file [2].

Impact

Successful exploitation results in a crash of SoX due to an assertion failure, causing a denial of service. The assertion is triggered before reaching any critical code paths, so no arbitrary code execution, information disclosure, or privilege escalation is expected. The impact is limited to availability [1][2].

Mitigation

As of the available references, no official patch has been released by the SoX upstream (which is mostly inactive). The repository maintainer noted that the bug is “not likely exploitable” [1]. Users can apply a patch from the oss-security mailing list that fixes the truncation issue leading to the assertion [1]. Alternatively, avoid processing untrusted audio files with SoX until a fix is applied. The vulnerability is not listed on CISA's Known Exploited Vulnerabilities (KEV) catalog.