CVE-2014-4655

🗓️ 03 Jul 2014 01:00:00Reported by mitreType

cve🔗 web.nvd.nist.gov👁 124 Views🌐 WEB

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service

Reporter	Title	Published	Views	Family All 325
BDU FSTEC	Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the SUSE Linux Enterprise operating system that allow attackers to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec
BDU FSTEC	Vulnerabilities in the OpenSUSE operating system that allow malicious actors to compromise the confidentiality, integrity, and accessibility of protected information	28 Apr 201500:00	–	bdu_fstec

NVD

Node

linux linux_kernelRange<3.15.2

Node

suse linux_enterprise_serverMatch10sp4ltss

Node

canonical ubuntu_linuxMatch12.04esm

Source	Link
git	www.git.kernel.org/
rhn	www.rhn.redhat.com/errata/RHSA-2014-1083.html
secunia	www.secunia.com/advisories/60564
securitytracker	www.securitytracker.com/id/1036763
ubuntu	www.ubuntu.com/usn/USN-2335-1
github	www.github.com/torvalds/linux/commit/82262a46627bebb0febcc26664746c25cef08563
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
ubuntu	www.ubuntu.com/usn/USN-2334-1
kernel	www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2
openwall	www.openwall.com/lists/oss-security/2014/06/26/6

Parameter	Position	Path	Description	CWE
SNDRV_CTL_IOCTL_ELEM_REPLACE	path	/dev/snd/controlCX	The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, allowing local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.	CWE-190

17 Jun 2026 00:10Current

5.8Medium risk

Vulners AI Score5.8

CVSS 24.9

EPSS0.00494

CWE-190