Skip to main content

Browse the archive

https://github.com/torvalds/linux
13 June 2022, 11:31:42 UTC
Revision d81a12bc29ae4038770e05dce4ab7f26fd5880fb authored by Dan Rosenberg on 25 December 2010, 21:23:40 UTC, committed by Takashi Iwai on 30 December 2010, 12:20:55 UTC 
sound: Prevent buffer overflow in OSS load_mixer_volumes
 
The load_mixer_volumes() function, which can be triggered by
unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
a buffer overflow.  Because the provided "name" argument isn't
guaranteed to be NULL terminated at the expected 32 bytes, it's possible
to overflow past the end of the last element in the mixer_vols array.
Further exploitation can result in an arbitrary kernel write (via
subsequent calls to load_mixer_volumes()) leading to privilege
escalation, or arbitrary kernel reads via get_mixer_levels().  In
addition, the strcmp() may leak bytes beyond the mixer_vols array.

Signed-off-by: Dan Rosenberg <drosenberg@vsecurity.com>
Cc: stable <stable@kernel.org>
Signed-off-by: Takashi Iwai <tiwai@suse.de>
1 parent 7693457
History
Tip revision: d81a12bc29ae4038770e05dce4ab7f26fd5880fb authored by Dan Rosenberg on 25 December 2010, 21:23:40 UTC
sound: Prevent buffer overflow in OSS load_mixer_volumes
Tip revision: d81a12b
File Mode Size
Documentation
arch
block
crypto
drivers
firmware
fs
include
init
ipc
kernel
lib
mm
net
samples
scripts
security
sound
tools
usr
virt
.gitignore -rw-r--r-- 936 bytes
.mailmap -rw-r--r-- 3.9 KB
COPYING -rw-r--r-- 18.3 KB
CREDITS -rw-r--r-- 91.8 KB
Kbuild -rw-r--r-- 2.4 KB
Kconfig -rw-r--r-- 252 bytes
MAINTAINERS -rw-r--r-- 178.3 KB
Makefile -rw-r--r-- 50.9 KB
README -rw-r--r-- 17.1 KB
REPORTING-BUGS -rw-r--r-- 3.3 KB

README

back to top