[CVE-2010-4527 Hardy] sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527

[Stefan Bader]

On 03/17/2011 10:58 PM, Leann Ogasawara wrote:
> The following changes since commit 7fec2f29a52bd5c07921df6e0dc443de7ef5c9f4:
>   Brad Figg (1):
>         UBUNTU: Ubuntu-2.6.24-29.88
> 
> are available in the git repository at:
> 
>   git://kernel.ubuntu.com/ogasawara/ubuntu-hardy.git CVE-2010-4527
> 
> Dan Rosenberg (1):
>       sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527
> 
>  sound/oss/soundcard.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> From 757fccef9f476beb37e1571a193c309c4c71f6b1 Mon Sep 17 00:00:00 2001
> From: Dan Rosenberg <drosenberg at vsecurity.com>
> Date: Sat, 25 Dec 2010 16:23:40 -0500
> Subject: [PATCH] sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527
> 
> CVE-2010-4527
> 
> BugLink: http://bugs.launchpad.net/bugs/737073
> 
> The load_mixer_volumes() function, which can be triggered by
> unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
> a buffer overflow.  Because the provided "name" argument isn't
> guaranteed to be NULL terminated at the expected 32 bytes, it's possible
> to overflow past the end of the last element in the mixer_vols array.
> Further exploitation can result in an arbitrary kernel write (via
> subsequent calls to load_mixer_volumes()) leading to privilege
> escalation, or arbitrary kernel reads via get_mixer_levels().  In
> addition, the strcmp() may leak bytes beyond the mixer_vols array.
> 
> Signed-off-by: Dan Rosenberg <drosenberg at vsecurity.com>
> Cc: stable <stable at kernel.org>
> Signed-off-by: Takashi Iwai <tiwai at suse.de>
> (cherry picked from commit d81a12bc29ae4038770e05dce4ab7f26fd5880fb)
> 
> Signed-off-by: Leann Ogasawara <leann.ogasawara at canonical.com>
Acked-by: Stefan Bader <stefan.bader at canonical.com>
> ---
>  sound/oss/soundcard.c |    4 ++--
>  1 files changed, 2 insertions(+), 2 deletions(-)
> 
> diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
> index a9c23b2..eac3c00 100644
> --- a/sound/oss/soundcard.c
> +++ b/sound/oss/soundcard.c
> @@ -87,7 +87,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
>  	int             i, n;
>  
>  	for (i = 0; i < num_mixer_volumes; i++) {
> -		if (strcmp(name, mixer_vols[i].name) == 0) {
> +		if (strncmp(name, mixer_vols[i].name, 32) == 0) {
>  			if (present)
>  				mixer_vols[i].num = i;
>  			return mixer_vols[i].levels;
> @@ -99,7 +99,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
>  	}
>  	n = num_mixer_volumes++;
>  
> -	strcpy(mixer_vols[n].name, name);
> +	strncpy(mixer_vols[n].name, name, 32);
>  
>  	if (present)
>  		mixer_vols[n].num = n;