CVE-2018-7566: Buffer Overflow
ALSA sequencer core initializes the event pool on demand by invoking sndseqpoolinit() when the first write happens and the pool is empty. A user can reset the pool size manually via ioctl concurrently, and this may lead to UAF or out-of-bound access.
References:
http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html
https://marc.info/?l=alsa-devel&m=151859118611846&w=2
An upstream fix:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d15d662e89fc667b90cd294b0eb45694e33144da
Other sources
The Linux kernel 4.15 has a Buffer Overflow via an SNDRVSEQIOCTLSETCLIENTPOOL ioctl write operation to /dev/snd/seq by a local user.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1
Event History
Frequently Asked Questions
What is CVE-2018-7566?
CVE-2018-7566 is a vulnerability in the Linux kernel 4.15 that allows a local user to trigger a buffer overflow via a write operation to /dev/snd/seq using the SNDRV_SEQ_IOCTL_SET_CLIENT_POOL ioctl.
How severe is CVE-2018-7566?
CVE-2018-7566 has a severity level of medium.
Which versions of Linux are affected by CVE-2018-7566?
CVE-2018-7566 affects Linux kernel versions 4.15, 4.16, and 4.4.0-1022.22, among others.
How can I fix CVE-2018-7566?
To fix CVE-2018-7566, it is recommended to update to Linux kernel version 4.16 or later.
Where can I find more information about CVE-2018-7566?
You can find more information about CVE-2018-7566 in the references provided: http://mailman.alsa-project.org/pipermail/alsa-devel/2018-February/132026.html, https://marc.info/?l=alsa-devel&m=151859118611846&w=2, https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d15d662e89fc667b90cd294b0eb45694e33144da.