[CVE-2010-4527 Dapper] sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527

Tim Gardner tim.gardner at canonical.com
Fri Mar 18 01:31:34 UTC 2011


On 03/17/2011 03:59 PM, Leann Ogasawara wrote:
> The following changes since commit 2ce9a046a401ab70b7719085dd1b51e2f4a56a42:
>    Brad Figg (1):
>          UBUNTU: Ubuntu-2.6.15-57.95
>
> are available in the git repository at:
>
>    git://kernel.ubuntu.com/ogasawara/ubuntu-dapper.git CVE-2010-4527
>
> Dan Rosenberg (1):
>        sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527
>
>   sound/oss/soundcard.c |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
>  From 9a0b6c4bd252c7888731071956e5ec904a6fa82c Mon Sep 17 00:00:00 2001
> From: Dan Rosenberg<drosenberg at vsecurity.com>
> Date: Sat, 25 Dec 2010 16:23:40 -0500
> Subject: [PATCH] sound: Prevent buffer overflow in OSS load_mixer_volumes, CVE-2010-4527
>
> CVE-2010-4527
>
> BugLink: http://bugs.launchpad.net/bugs/737073
>
> The load_mixer_volumes() function, which can be triggered by
> unprivileged users via the SOUND_MIXER_SETLEVELS ioctl, is vulnerable to
> a buffer overflow.  Because the provided "name" argument isn't
> guaranteed to be NULL terminated at the expected 32 bytes, it's possible
> to overflow past the end of the last element in the mixer_vols array.
> Further exploitation can result in an arbitrary kernel write (via
> subsequent calls to load_mixer_volumes()) leading to privilege
> escalation, or arbitrary kernel reads via get_mixer_levels().  In
> addition, the strcmp() may leak bytes beyond the mixer_vols array.
>
> Signed-off-by: Dan Rosenberg<drosenberg at vsecurity.com>
> Cc: stable<stable at kernel.org>
> Signed-off-by: Takashi Iwai<tiwai at suse.de>
> (cherry picked from commit d81a12bc29ae4038770e05dce4ab7f26fd5880fb)
>
> Signed-off-by: Leann Ogasawara<leann.ogasawara at canonical.com>
> ---
>   sound/oss/soundcard.c |    4 ++--
>   1 files changed, 2 insertions(+), 2 deletions(-)
>
> diff --git a/sound/oss/soundcard.c b/sound/oss/soundcard.c
> index d33bb46..4f12363 100644
> --- a/sound/oss/soundcard.c
> +++ b/sound/oss/soundcard.c
> @@ -86,7 +86,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
>   	int             i, n;
>
>   	for (i = 0; i<  num_mixer_volumes; i++) {
> -		if (strcmp(name, mixer_vols[i].name) == 0) {
> +		if (strncmp(name, mixer_vols[i].name, 32) == 0) {
>   			if (present)
>   				mixer_vols[i].num = i;
>   			return mixer_vols[i].levels;
> @@ -98,7 +98,7 @@ int *load_mixer_volumes(char *name, int *levels, int present)
>   	}
>   	n = num_mixer_volumes++;
>
> -	strcpy(mixer_vols[n].name, name);
> +	strncpy(mixer_vols[n].name, name, 32);
>
>   	if (present)
>   		mixer_vols[n].num = n;

Acked-by: Tim Gardner <tim.gardner at canonical.com>

-- 
Tim Gardner tim.gardner at canonical.com



More information about the kernel-team mailing list