diff options
| author | fire855 <thefire855@gmail.com> | 2017-02-12 02:29:04 +0100 |
|---|---|---|
| committer | Mister Oyster <oysterized@gmail.com> | 2017-04-11 10:59:45 +0200 |
| commit | 233c3ee7a5e16111030bef6714210fd02f44d0f4 (patch) | |
| tree | 3af205685aaea263eda782767ed3f7e3b9dc48ff | |
| parent | c68d6e8dea2625833ae6e95f1b0c2edaa72df9f7 (diff) | |
Fix "Elevation of privilege vulnerability in kernel sound subsystem"
CVE-2017-0404
An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process.
| -rw-r--r-- | sound/core/info.c | 4 |
1 files changed, 3 insertions, 1 deletions
diff --git a/sound/core/info.c b/sound/core/info.c index 08070e1ee..332c9a1ef 100644 --- a/sound/core/info.c +++ b/sound/core/info.c @@ -253,6 +253,7 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer struct snd_info_buffer *buf; ssize_t size = 0; loff_t pos; + unsigned long realloc_size; data = file->private_data; if (snd_BUG_ON(!data)) @@ -261,7 +262,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer pos = *offset; if (pos < 0 || (long) pos != pos || (ssize_t) count < 0) return -EIO; - if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos) + realloc_size = (unsigned long) pos + (unsigned long) count; + if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX) return -EIO; switch (entry->content) { case SNDRV_INFO_CONTENT_TEXT: |