CVE-2017-15265: Race Condition
A use-after-free vulnerability was found at creating and deleting a port via an ioctl on /dev/snd/seq. The sndseqcreateport() function creates a port object and returns its pointer, but it doesn't take a refcount and can be deleted immediately by another thread.
Meanwhile, sndseqioctlcreateport() still calls the function sndseqsystemclientevportstart() with the created port object that is being deleted, which triggers use-after-free. An attacker can race this use for memory corruption or possibly privilege escalation.
At the time of writing, the permissions on the device file required a local console user to be issue the ioctl to allow for the exploit to work correctly. Remote users accessing the system via a shell were not granted permissions to issue an IOCTL that can trigger this condition.
References:
http://seclists.org/oss-sec/2017/q4/58
http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026
Other sources
Race condition in the ALSA subsystem in the Linux kernel before 4.13.8 allows local users to cause a denial of service (use-after-free) or possibly have unspecified other impact via crafted /dev/snd/seq ioctl calls, related to sound/core/seq/seqclientmgr.c and sound/core/seq/seqports.c.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.187-1Fixed in 6.12.107-1Fixed in 7.1.13-1 - Upgrade
Upgrade
Linux kernel (ALSA sequencer)to a version that resolves this vulnerability.Fixed in 4.13.8 - Compensating control
Restrict access to the device file /dev/snd/seq so only local console users (not remote users via a shell) can issue the relevant ioctl calls.
Event History
Frequently Asked Questions
What is the severity of CVE-2017-15265?
CVE-2017-15265 is classified as a high-severity use-after-free vulnerability that can lead to potential system crashes or arbitrary code execution.
How do I fix CVE-2017-15265?
To fix CVE-2017-15265, upgrade to a patched version of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.10-1, or 6.12.11-1.
Which Linux Kernel versions are affected by CVE-2017-15265?
CVE-2017-15265 affects Linux Kernel versions prior to 3.2.95 and versions between 3.3 and 4.13.8.
What causes CVE-2017-15265?
CVE-2017-15265 is caused by the snd_seq_create_port() function not maintaining reference counts, allowing immediate deletion of a port object by another thread.
Is CVE-2017-15265 specific to any particular operating system?
CVE-2017-15265 primarily affects the Linux kernel and, by extension, Linux-based operating systems like Android.