Linux Kernel snd_seq_oss_synth_make_info() Discloses Kernel Memory Information to Local Users
|
|
SecurityTracker Alert ID: 1020636
|
|
SecurityTracker URL: http://securitytracker.com/id?1020636
|
|
CVE Reference: CVE-2008-3272
(Links to External Site)
|
Date: Aug 6 2008
|
Impact: Disclosure of system information, Disclosure of user information
|
Fix Available: Yes
Vendor Confirmed: Yes
|
Version(s): prior to 2.6.27-rc2
|
Description: A vulnerability was reported in the Linux Kernel. A local user can obtain information from kernel memory.
The snd_seq_oss_synth_make_info() function does not validate the user-supplied device number before returning information to the
calling user. A local user may be able to obtain information from kernel memory.
Tobias Klein reported this vulnerability.
|
Impact: A local user can obtain information from kernel memory.
|
Solution: The vendor has issued a fix (2.6.27-rc2).
A source code fix is available at:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=82e68f7ffec3
800425f2391c8c86277606860442
The vendor's advisory is available at:
http://kernel.org/pub/linux/kernel/v2.6/testing/ChangeLog-2.6.27-rc2
|
Vendor URL: www.kernel.org/ (Links to External Site)
|
Cause: Access control error
|
Underlying OS: Linux (Caldera/SCO), Linux (Conectiva), Linux (Debian), Linux (EnGarde), Linux (Gentoo), Linux (HP Secure OS), Linux (Immunix), Linux (Mandriva/Mandrake), Linux (Progeny Debian), Linux (Red Hat Enterprise), Linux (Red Hat Fedora), Linux (Red Hat Linux), Linux (SGI), Linux (Slackware), Linux (Sun), Linux (SuSE), Linux (Trustix), Linux (Turbo Linux), Linux (Ubuntu), Linux (Xandros)
|
|
Message History:
This archive entry has one or more follow-up message(s) listed below.
|
Source Message Contents
|
Date: Wed, 6 Aug 2008 15:48:59 -0400
Subject: Linux kernel
|
commit 82e68f7ffec3800425f2391c8c86277606860442
Author: Willy Tarreau <w@1wt.eu>
Date: Sat Aug 2 18:25:16 2008 +0200
sound: ensure device number is valid in snd_seq_oss_synth_make_info
snd_seq_oss_synth_make_info() incorrectly reports information
to userspace without first checking for the validity of the
device number, leading to possible information leak (CVE-2008-3272).
Reported-By: Tobias Klein <tk@trapkit.de>
Acked-and-tested-by: Takashi Iwai <tiwai@suse.de>
Cc: stable@kernel.org
Signed-off-by: Willy Tarreau <w@1wt.eu>
Signed-off-by: Linus Torvalds <torvalds@linux-foundation.org>
|
|
