CVE-2014-4654: Use After Free
Last updated 24 July 2024
Other sources
Linux kernel built with the Advanced Linux Sound Architecture(ALSA) sound system support(CONFIGSND) is vulnerable to a use after free flaw. It could occur when user space application removes arbitrary controls.
A user/application could use this flaw to crash the system kernel resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/82262a46627bebb0febcc26664746c25cef08563
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/06/26/6
— Red Hat
The sndctlelemadd function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not check authorization for SNDRVCTLIOCTLELEMREPLACE commands, which allows local users to remove kernel controls and cause a denial of service (use-after-free and system crash) by leveraging /dev/snd/controlCX access for an ioctl call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4654?
CVE-2014-4654 is considered to have a medium to high severity due to its potential to cause system crashes.
How do I fix CVE-2014-4654?
To fix CVE-2014-4654, update your Linux kernel to a version above 3.15.2 or apply the appropriate patches provided by your distribution.
Which versions of Linux are affected by CVE-2014-4654?
CVE-2014-4654 affects Linux kernel versions up to and including 3.15.2, as well as specific versions of SUSE and Ubuntu Linux.
What type of vulnerability is CVE-2014-4654?
CVE-2014-4654 is classified as a use-after-free vulnerability, allowing unintended memory access.
Can CVE-2014-4654 be exploited remotely?
Exploitation of CVE-2014-4654 typically requires local access to the affected system, making remote exploitation unlikely.