From 233c3ee7a5e16111030bef6714210fd02f44d0f4 Mon Sep 17 00:00:00 2001 From: fire855 Date: Sun, 12 Feb 2017 02:29:04 +0100 Subject: Fix "Elevation of privilege vulnerability in kernel sound subsystem" CVE-2017-0404 An elevation of privilege vulnerability in the kernel sound subsystem could enable a local malicious application to execute arbitrary code within the context of the kernel. This issue is rated as High because it first requires compromising a privileged process. --- sound/core/info.c | 4 +++- 1 file changed, 3 insertions(+), 1 deletion(-) (limited to 'sound/core') diff --git a/sound/core/info.c b/sound/core/info.c index 08070e1ee..332c9a1ef 100644 --- a/sound/core/info.c +++ b/sound/core/info.c @@ -253,6 +253,7 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer struct snd_info_buffer *buf; ssize_t size = 0; loff_t pos; + unsigned long realloc_size; data = file->private_data; if (snd_BUG_ON(!data)) @@ -261,7 +262,8 @@ static ssize_t snd_info_entry_write(struct file *file, const char __user *buffer pos = *offset; if (pos < 0 || (long) pos != pos || (ssize_t) count < 0) return -EIO; - if ((unsigned long) pos + (unsigned long) count < (unsigned long) pos) + realloc_size = (unsigned long) pos + (unsigned long) count; + if (realloc_size < (unsigned long) pos || realloc_size > UINT_MAX) return -EIO; switch (entry->content) { case SNDRV_INFO_CONTENT_TEXT: -- cgit v1.2.3