CVE-2012-6703: Integer Overflow
An integer overflow was found in sndcomprallocatebuffer(), that could result into allocating smaller buffer than expected.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b35cc8225845112a616e3a2266d2fde5ab13d3ab
The patch was incomplete and introduced another issues known as CVE-2014-9904.
CVE assignment:
http://seclists.org/oss-sec/2016/q2/616
Other sources
Integer overflow in the sndcomprallocatebuffer function in sound/core/compressoffload.c in the ALSA subsystem in the Linux kernel before 3.6-rc6-next-20120917 allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRVCOMPRESSSETPARAMS ioctl call.
— MITRE
Affected Software
Remediation
Event History
Frequently Asked Questions
Who can exploit this issue?
A local user with the privileges needed to issue a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call can trigger the integer overflow. The provided CVSS vector indicates local access, low attack complexity, low privileges required, and no user interaction.
Which systems are affected?
The issue affects the ALSA compress-offload code in the Linux kernel before 3.6-rc6-next-20120917. Systems without the affected sound/core/compress_offload.c functionality are not identified as affected by the provided data.
What is the practical impact of successful exploitation?
The overflow can cause a buffer smaller than expected to be allocated, resulting in a denial of service through insufficient memory allocation. The description also notes the possibility of unspecified additional impact.
Is applying the referenced upstream patch sufficient?
No. The provided data states that the upstream patch was incomplete and introduced a separate issue tracked as CVE-2014-9904; remediation should account for that follow-on vulnerability as well.