Description
In the Linux kernel, the following vulnerability has been resolved: ALSA: seq: Clear variable event pointer on read snd_seq_read() copies a queued variable-length event header to userspace before expanding the payload. Queued variable-length events use SNDRV_SEQ_EXT_CHAINED internally, and data.ext.ptr points at the first extension cell. The read side strips SNDRV_SEQ_EXT_* bits from data.ext.len before the copy, but it leaves data.ext.ptr untouched. A userspace sequencer client can therefore write a direct variable event to itself and read back the extension-cell kernel address from the returned header. Clear the temporary header pointer before copy_to_user(). The original queued event remains unchanged and is still passed to snd_seq_expand_var_event(), so payload expansion keeps using the internal chain.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
Linux Linux
Default version status: unaffected
1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 8a631e1aaa1ebbc9de916927fa01707244e18291affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 14fe4f75fd5309d6b75f8e840ada88912b374207affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < f29243c211928114f8b906e0a3fee77c236f14c8affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < e0c3edd86414534cfd179fefe45b38c29c01ae7aaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 6b52211eba213c461f68922708a99d8190c1fcd5affected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31baffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < c2ac9287e89916da684c2a548798351e63eb59eeaffected1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 to < 705dd6dcbc0ea87351c660c1a6443f85f1001c76affected
Linux Linux
Default version status: affected
2.6.12affected0 to < 2.6.12unaffected5.10.273 to ≤ 5.10.*unaffected5.15.212 to ≤ 5.15.*unaffected6.1.178 to ≤ 6.1.*unaffected6.6.145 to ≤ 6.6.*unaffected6.12.97 to ≤ 6.12.*unaffected6.18.40 to ≤ 6.18.*unaffected7.1.5 to ≤ 7.1.*unaffected7.2 to ≤ *unaffected
References
- https://git.kernel.org/stable/c/8a631e1aaa1ebbc9de916927fa01707244e18291 ↗
- https://git.kernel.org/stable/c/14fe4f75fd5309d6b75f8e840ada88912b374207 ↗
- https://git.kernel.org/stable/c/f29243c211928114f8b906e0a3fee77c236f14c8 ↗
- https://git.kernel.org/stable/c/e0c3edd86414534cfd179fefe45b38c29c01ae7a ↗
- https://git.kernel.org/stable/c/6b52211eba213c461f68922708a99d8190c1fcd5 ↗
- https://git.kernel.org/stable/c/74ac1ce1f4afdb3b80b6742fa28fb86c8c51d31b ↗
- https://git.kernel.org/stable/c/c2ac9287e89916da684c2a548798351e63eb59ee ↗
- https://git.kernel.org/stable/c/705dd6dcbc0ea87351c660c1a6443f85f1001c76 ↗