CVE-2014-4653 — Use After Free in Kernel

CWE-416 — Use After Free13 documents8 sources
Severity
4.6MEDIUMNVD
EPSS
0.1%
top 79.49%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux KernelCanonical Ubuntu LinuxSuse Linux Enterprise Server
Timeline
PublishedJul 3
Latest updateMay 13

Description

sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not ensure possession of a read/write lock, which allows local users to cause a denial of service (use-after-free) and obtain sensitive information from kernel memory by leveraging /dev/snd/controlCX access.

CVSS vector

AV:L/AC:L/C:P/I:P/A:PExploitability: 3.9 | Impact: 6.4

Affected Packages3 packages

▶NVDlinux/linux_kernel< 3.15.2
▶Debianlinux/linux_kernel< 3.14.9-1+3

Also affects: Ubuntu Linux 12.04

Patches

Patch: github.com ↗Patch: github.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-cjv8-vgc3-fxvc: sound/core/control↗2022-05-13
▶
CVEList
CVE-2014-4653: sound/core/control↗2014-07-03
▶
OSV
CVE-2014-4653: sound/core/control↗2014-07-03
▶

📋Vendor Advisories

8
Ubuntu
Linux kernel (OMAP4) vulnerabilities↗2014-09-02
▶
Ubuntu
Linux kernel vulnerabilities↗2014-09-02
▶
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities↗2014-09-02
▶
Ubuntu
Linux kernel (EC2) vulnerabilities↗2014-09-02
▶
Ubuntu
Linux kernel vulnerabilities↗2014-09-02
▶

💬Community

1
Bugzilla
CVE-2014-4653 Kernel: ALSA: control: do not access controls outside of protected regions↗2014-06-26
▶
CVE-2014-4653 — Use After Free in Linux Kernel | cvebase