CVEvulnerability

CVE-2014-9904

7.8 HIGH Published 2016-06-27 Modified 2026-06-17 Official page ↗

Status: Modified
Published: 2016-06-27
Last modified: 2026-06-17
Assigner: [email protected]
CVSS 3.1 ([email protected]): 7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected]): 7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.

Affected configurations

• linux linux kernel (>= 3.7 < 3.12.62) • linux linux kernel (>= 3.13 < 3.16.37) • debian debian linux 8.0 • novell suse linux enterprise real time extension 12

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205 Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html Mailing List, Third Party Advisory
http://www.debian.org/security/2016/dsa-3616 Third Party Advisory
http://www.securityfocus.com/bid/91510 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036189 Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/6217e5ede23285ddfee10d2e4ba0cc2d4c046205 Patch, Vendor Advisory
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6217e5ede23285ddfee10d2e4ba0cc2d4c046205 Patch, Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00044.html Mailing List, Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00055.html Mailing List, Third Party Advisory
http://www.debian.org/security/2016/dsa-3616 Third Party Advisory
http://www.securityfocus.com/bid/91510 Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1036189 Third Party Advisory, VDB Entry
https://github.com/torvalds/linux/commit/6217e5ede23285ddfee10d2e4ba0cc2d4c046205 Patch, Vendor Advisory