CVE-2014-4653: Use After Free
Last updated 24 July 2024
Other sources
Linux kernel built with the Advanced Linux Sound Architecture(ALSA) sound system support(CONFIGSND) is vulnerable to a use after free flaw. It could occur when accessing card->controls list memory.
A user/application could use this flaw to crash the system kernel resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/fd9f26e4eca5d08a27d12c0933fceef76ed9663d
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/06/26/6
— Red Hat
sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4653?
CVE-2014-4653 is considered a high severity vulnerability due to its potential to crash the system kernel.
How do I fix CVE-2014-4653?
To fix CVE-2014-4653, update your Linux kernel to a patched version, such as 5.10.223-1 or 6.1.119-1 and later.
Which versions of Linux are affected by CVE-2014-4653?
CVE-2014-4653 affects Linux kernel versions prior to 3.15.2, as well as specific versions of SUSE Linux and Ubuntu.
What type of vulnerability is CVE-2014-4653?
CVE-2014-4653 is a use-after-free vulnerability related to the Advanced Linux Sound Architecture (ALSA) sound system.
Can CVE-2014-4653 be exploited remotely?
CVE-2014-4653 could potentially be exploited by a local user or application to crash the system, but it does not have remote exploitation capability.