CVE-2010-3442: Integer Overflow
Description of problem: The sndctlnew() function in sound/core/control.c allocates space for a sndkcontrol struct by performing arithmetic operations on a user-provided size without checking for integer overflow. If a user provides a large enough size, an overflow will occur, the allocated chunk will be too small, and a second user-influenced value will be written repeatedly past the bounds of this chunk. This code is reachable by unprivileged users who have permission to open a /dev/snd/controlC device (on many distros, this is group "audio") via the SNDRVCTLIOCTLELEMADD and SNDRVCTLIOCTLELEMREPLACE ioctls.
Upstream commit: http://git.kernel.org/?p=linux/kernel/git/tiwai/sound-2.6.git;a=commitdiff;h=5591bf07225523600450edd9e6ad258bb877b779
Acknowledgements:
Red Hat would like to thank Dan Rosenberg for reporting this issue.
Other sources
Multiple integer overflows in the sndctlnew function in sound/core/c ...
— Debian
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2010-3442?
CVE-2010-3442 has a medium severity rating due to potential memory corruption vulnerabilities that could affect system stability.
How do I fix CVE-2010-3442?
To fix CVE-2010-3442, you should update your Linux kernel to a version that is patched for this vulnerability.
Which systems are affected by CVE-2010-3442?
CVE-2010-3442 affects various Linux distributions, including certain versions of Debian, Ubuntu, Fedora, and openSUSE.
What are the consequences of exploiting CVE-2010-3442?
Exploiting CVE-2010-3442 could lead to a denial of service or potentially allow an attacker to execute arbitrary code on the affected system.
When was CVE-2010-3442 disclosed?
CVE-2010-3442 was disclosed in 2010 and affects some releases of the Linux kernel up to version 2.6.36.