CVE-2014-4654

Published: 3 July 2014

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRV_CTL_IOCTL_ELEM_REPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.

From the Ubuntu Security Team

A authorization bug was discovered with the snd_ctl_elem_add function of the Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local user could exploit his bug to cause a denial of service (remove kernel controls).

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://github.com/torvalds/linux/commit/82262a46627bebb0febcc26664746c25cef08563
• https://bugzilla.redhat.com/show_bug.cgi?id=1113445
• http://www.openwall.com/lists/oss-security/2014/06/26/6
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=82262a46627bebb0febcc26664746c25cef08563
• https://ubuntu.com/security/notices/USN-2332-1
• https://ubuntu.com/security/notices/USN-2333-1
• https://ubuntu.com/security/notices/USN-2334-1
• https://ubuntu.com/security/notices/USN-2335-1
• https://ubuntu.com/security/notices/USN-2336-1
• https://ubuntu.com/security/notices/USN-2337-1
• https://www.cve.org/CVERecord?id=CVE-2014-4654
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1339303