PT-2016-3549 · Linux+3 · Linux Kernel+3

Publicado

2014-10-23

·

Atualizado

2023-01-18

·

CVE-2014-9904

CVSS v3.1

7.8

Alta

VetorAV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.17
Description The issue is related to the snd compress check input function in the ALSA subsystem, which does not properly check for an integer overflow. This allows local users to cause a denial of service due to insufficient memory allocation, or possibly have other unspecified impacts, via a crafted SNDRV COMPRESS SET PARAMS ioctl call.
Recommendations For Linux kernel versions prior to 3.17, update to version 3.17 or later to resolve the issue. As a temporary workaround, consider restricting access to the SNDRV COMPRESS SET PARAMS ioctl call to minimize the risk of exploitation.

Exploit

Correção

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Identificadores relacionados

ALT-PU-2014-2297
ALT-PU-2015-1794
CVE-2014-9904
DSA-3616-1
OPENSUSE-SU-2016_2144-1
OPENSUSE-SU-2016_2184-1
SUSE-SU-2016:1937-1
SUSE-SU-2016:2105-1
SUSE-SU-2016_2105-1
SUSE-SU-2017:0471-1
USN-3127-1
USN-3127-2

Produtos afetados

Alt Linux
Linux Kernel
Suse
Ubuntu