Published: 03/07/2014 Updated: 07/11/2023

CVSS v2 Base Score: 4.9 | Impact Score: 6.9 | Exploitability Score: 3.9

VMScore: 437

Vector: AV:L/AC:L/Au:N/C:N/I:N/A:C

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel prior to 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
suse linux enterprise server 10
canonical ubuntu linux 12.04

Debian Bug report logs - #751417 linux-image-320-4-5kc-malta: no SIGKILL after prctl(PR_SET_SECCOMP, 1, ) on MIPS (CVE-2014-4157) Package: src:linux; Maintainer for src:linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: Plamen Alexandrov <plamen@aomedacom> Date: Thu, 12 Jun 2014 16:21:01 ...

Several security issues were fixed in the kernel ...

A use-after-free flaw was found in the way the Linux kernel's Advanced Linux Sound Architecture (ALSA) implementation handled user controls A local, privileged user could use this flaw to crash the system ...

CWE-190 https://bugzilla.redhat.com/show_bug.cgi?id=1113445 https://github.com/torvalds/linux/commit/82262a46627bebb0febcc26664746c25cef08563 http://www.openwall.com/lists/oss-security/2014/06/26/6 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2 http://secunia.com/advisories/59434 http://www.securityfocus.com/bid/68162 http://secunia.com/advisories/59777 http://secunia.com/advisories/60564 http://rhn.redhat.com/errata/RHSA-2014-1083.html http://www.ubuntu.com/usn/USN-2334-1 http://www.ubuntu.com/usn/USN-2335-1 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html http://secunia.com/advisories/60545 http://www.securitytracker.com/id/1036763 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=82262a46627bebb0febcc26664746c25cef08563 https://nvd.nist.gov https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=751417 https://usn.ubuntu.com/2335-1/https://access.redhat.com/security/cve/cve-2014-4655

CVE-2014-4655

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect