CVE-2007-4571

2007-09-2600:00:00

ubuntu.com

2.1 Low

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:N/C:P/I:N/A:N

0.0004 Low

EPSS

Percentile

0.4%

JSON

The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced
Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does
not return the correct write size, which allows local users to obtain
sensitive information (kernel memory contents) via a small count argument,
as demonstrated by multiple reads of /proc/driver/snd-page-alloc.

Bugs

<https://bugs.launchpad.net/ubuntu/+source/linux-meta/+bug/187275>

Notes

Author	Note
jdstrand	kernel-sec has ‘ignored (2.6.18.dfsg.1-13etch3)’
kees	ABI changer – will roll this out when a more serious ABI change comes in

OSVersionArchitecturePackageVersionFilename
ubuntu6.06noarchlinux-source-2.6.15< 2.6.15-52.67UNKNOWN
ubuntu7.04noarchlinux-source-2.6.20< 2.6.20-17.36UNKNOWN
ubuntu7.10noarchlinux-source-2.6.22< 2.6.22-12.39UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	6.06	noarch	linux-source-2.6.15	< 2.6.15-52.67	UNKNOWN
ubuntu	7.04	noarch	linux-source-2.6.20	< 2.6.20-17.36	UNKNOWN
ubuntu	7.10	noarch	linux-source-2.6.22	< 2.6.22-12.39	UNKNOWN