Linux Kernel snd_seq_oss_synth_make_info() Discloses Kernel Memory Information to Local Users
|
|
SecurityTracker Alert ID: 1020636 |
|
SecurityTracker URL: http://securitytracker.com/id/1020636
|
|
CVE Reference:
CVE-2008-3272
(Links to External Site)
|
Date: Aug 6 2008
|
Impact:
Disclosure of system information, Disclosure of user information
|
Fix Available: Yes Vendor Confirmed: Yes
|
Version(s): prior to 2.6.27-rc2
|
Description:
A vulnerability was reported in the Linux Kernel. A local user can obtain information from kernel memory.
The snd_seq_oss_synth_make_info() function does not validate the user-supplied device number before returning information to the calling user. A local user may be able to obtain information from kernel memory.
Tobias Klein reported this vulnerability.
|
Impact:
A local user can obtain information from kernel memory.
|
Solution:
The vendor has issued a fix (2.6.27-rc2).
A source code fix is available at:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=82e68f7ffec3800425f2391c8c86277606860442
The vendor's advisory is available at:
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause:
Access control error
|
Underlying OS:
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 6 Aug 2008 15:48:59 -0400
Subject: Linux kernel
|
commit 82e68f7ffec3800425f2391c8c86277606860442
Author: Willy Tarreau <w@1wt.eu>
Date: Sat Aug 2 18:25:16 2008 +0200
sound: ensure device number is valid in snd_seq_oss_synth_make_info
snd_seq_oss_synth_make_info() incorrectly reports information
to userspace without first checking for the validity of the
device number, leading to possible information leak (CVE-2008-3272).
Reported-By: Tobias Klein <tk@trapkit.de>
Acked-and-tested-by: Takashi Iwai <tiwai@suse.de>
Cc: stable@kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
