REDHAT-BUG-1501878: Use After Free
A use-after-free vulnerability was found at creating and deleting a port via an ioctl on /dev/snd/seq. The sndseqcreateport() function creates a port object and returns its pointer, but it doesn't take a refcount and can be deleted immediately by another thread.
Meanwhile, sndseqioctlcreateport() still calls the function sndseqsystemclientevportstart() with the created port object that is being deleted, which triggers use-after-free. An attacker can race this use for memory corruption or possibly privilege escalation.
At the time of writing, the permissions on the device file required a local console user to be issue the ioctl to allow for the exploit to work correctly. Remote users accessing the system via a shell were not granted permissions to issue an IOCTL that can trigger this condition.
References:
http://seclists.org/oss-sec/2017/q4/58
http://mailman.alsa-project.org/pipermail/alsa-devel/2017-October/126292.html
An upstream patch:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=71105998845fb012937332fe2e806d443c09e026
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-1501878?
The severity of REDHAT-BUG-1501878 is considered high due to the potential for a use-after-free vulnerability that could lead to denial of service or execution of arbitrary code.
How do I fix REDHAT-BUG-1501878?
To fix REDHAT-BUG-1501878, you should apply the latest patches from the ALSA project or Red Hat that address this vulnerability.
Which software is affected by REDHAT-BUG-1501878?
REDHAT-BUG-1501878 affects the ALSA Sound System, particularly involving the port creation functions.
Is REDHAT-BUG-1501878 exploitable remotely?
REDHAT-BUG-1501878 is not typically exploitable remotely as it requires local access to the affected ALSA device.
What type of vulnerability is REDHAT-BUG-1501878?
REDHAT-BUG-1501878 is a use-after-free vulnerability that arises during the creation and deletion of ports in the ALSA Sound System.