CVE-2017-1000380
published 2017-06-17CVE-2017-1000380: sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read…
PriorityP424medium5.5CVSS 3.0
AVLACLPRLUINSUCHINAN
EPSS
0.72%
50.4th percentile
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.11.6-1 (bookworm) | linux 4.11.6-1 (bookworm) |
| linux | linux_kernel | <= 4.11.4 | — |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 4.11.6-1 | 4.11.6-1 |
| linux | linux_kernel | >= 0 < 3.13.0-125.174 | 3.13.0-125.174 |
| linux | linux_kernel | >= 0 < 4.4.0-87.110 | 4.4.0-87.110 |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (HWE) kernel vulnerabilities
vendor_ubuntu·2017-07-28·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel (HWE) kernel vulnerabilities
Title: Linux kernel (HWE) kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly validate some ioctl arguments. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-7346)
Murray McAllister discovered that
Ubuntu
Linux kernel (AWS, GKE) vulnerabilities
vendor_ubuntu·2017-07-25·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel (AWS, GKE) vulnerabilities
Title: Linux kernel (AWS, GKE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did no
Ubuntu
Linux kernel (Xenial HWE) vulnerabilities
vendor_ubuntu·2017-07-24·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel (Xenial HWE) vulnerabilities
Title: Linux kernel (Xenial HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3364-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsys
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-07-24·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters subsystem of the Linux kernel for ARM64. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2015-8955)
It was discovered that the SCSI generic (sg) driver in the
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
USN-3360-1 fixed vulnerabilities in the Linux kernel for Ubuntu 14.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 14.04 LTS for Ubuntu
12.04 ESM.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters s
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-07-20·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly validate some ioctl arguments. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-7346)
Murray McAllister discovered that the DRM driv
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2017-07-20·CVSS 5.5
CVE-2014-9900 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the Linux kernel.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
Dmitry Vyukov, Andrey Konovalov, Florian Westphal, and Eric Dumazet
discovered that the netfiler subsystem in the Linux kernel mishandled IPv6
packet reassembly. A local user could use this to cause a denial of service
(system crash) or possibly execute arbitrary code. (CVE-2016-9755)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-
Red Hat
kernel: information leak due to a data race in ALSA timer
vendor_redhat·2017-06-12·CVSS 5.5
CVE-2017-1000380 [MEDIUM] CWE-200 kernel: information leak due to a data race in ALSA timer
kernel: information leak due to a data race in ALSA timer
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
It was found that the timer functionality in the Linux kernel ALSA subsystem is prone to a race condition between read and ioctl system call handlers, resulting in an uninitialized memory disclosure to user space. A local user could use this flaw to read information belonging to other users.
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6. This has been rated as having Moderate
Debian
CVE-2017-1000380: linux - sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data rac...
vendor_debian·2017·CVSS 5.5
CVE-2017-1000380 [MEDIUM] CVE-2017-1000380: linux - sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data rac...
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
Scope: local
bookworm: resolved (fixed in 4.11.6-1)
bullseye: resolved (fixed in 4.11.6-1)
forky: resolved (fixed in 4.11.6-1)
sid: resolved (fixed in 4.11.6-1)
trixie: resolved (fixed in 4.11.6-1)
GHSA
GHSA-xfwq-gq62-2hc2: sound/core/timer
ghsa_unreviewed·2022-05-17
CVE-2017-1000380 [MEDIUM] CWE-200 GHSA-xfwq-gq62-2hc2: sound/core/timer
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
OSV
linux-hwe vulnerabilities
osv·2017-07-28·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux-hwe vulnerabilities
linux-hwe vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly validate some ioctl arguments. A local
attacker could use this to cause a denial of service (system crash).
(CVE-2017-7346)
Murray McAllister discovered that the DRM driver for VMware Virtual GPUs in
the Linux kernel did not properly initialize m
OSV
linux-aws, linux-gke vulnerabilities
osv·2017-07-25·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux-aws, linux-gke vulnerabilities
linux-aws, linux-gke vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly validate some ioctl arguments. A local
attacker could use this to
OSV
linux, linux-raspi2, linux-snapdragon vulnerabilities
osv·2017-07-24·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux, linux-raspi2, linux-snapdragon vulnerabilities
linux, linux-raspi2, linux-snapdragon vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive information (kernel memory).
(CVE-2017-1000380)
Li Qiang discovered that the DRM driver for VMware Virtual GPUs in the
Linux kernel did not properly validate some ioctl arguments. A local
attacker
OSV
linux-lts-xenial vulnerabilities
osv·2017-07-24·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux-lts-xenial vulnerabilities
linux-lts-xenial vulnerabilities
USN-3364-1 fixed vulnerabilities in the Linux kernel for Ubuntu 16.04
LTS. This update provides the corresponding updates for the Linux
Hardware Enablement (HWE) kernel from Ubuntu 16.04 LTS for Ubuntu
14.04 LTS.
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
Alexander Potapenko discovered a race condition in the Advanced Linux Sound
Architecture (ALSA) subsystem in the Linux kernel. A local attacker could
use this to expose sensitive infor
OSV
linux vulnerabilities
osv·2017-07-21·CVSS 5.5
CVE-2014-9900 [MEDIUM] linux vulnerabilities
linux vulnerabilities
It was discovered that the Linux kernel did not properly initialize a Wake-
on-Lan data structure. A local attacker could use this to expose sensitive
information (kernel memory). (CVE-2014-9900)
It was discovered that the Linux kernel did not properly restrict access to
/proc/iomem. A local attacker could use this to expose sensitive
information. (CVE-2015-8944)
It was discovered that a use-after-free vulnerability existed in the
performance events and counters subsystem of the Linux kernel for ARM64. A
local attacker could use this to cause a denial of service (system crash)
or possibly execute arbitrary code. (CVE-2015-8955)
It was discovered that the SCSI generic (sg) driver in the Linux kernel
contained a double-free vulnerability. A local attacker could use
OSV
CVE-2017-1000380: sound/core/timer
osv·2017-06-17·CVSS 5.5
CVE-2017-1000380 [MEDIUM] CVE-2017-1000380: sound/core/timer
sound/core/timer.c in the Linux kernel before 4.11.5 is vulnerable to a data race in the ALSA /dev/snd/timer driver resulting in local users being able to read information belonging to other users, i.e., uninitialized memory contents may be disclosed when a read and an ioctl happen at the same time.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer [fedora-all]
bugzilla·2017-06-20·CVSS 5.5
CVE-2017-1000380 [MEDIUM] CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer [fedora-all]
CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of fedora-all.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supporte
Bugzilla
CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer
bugzilla·2017-06-20·CVSS 5.5
CVE-2017-1000380 [MEDIUM] CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer
CVE-2017-1000380 kernel: information leak due to a data race in ALSA timer
A information leak was found in /dev/snd/timer driver which was prone to a data race, leading to uninitialized memory from the kernel heap being copied to user space. A local user with access to /dev/snd/timer could use this flaw to read kernel space memory of other users.
References:
http://seclists.org/oss-sec/2017/q2/455
https://bugzilla.suse.com/show_bug.cgi?id=1044125
CVE-ID assignment:
http://seclists.org/oss-sec/2017/q2/463
Upstream patches:
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=d11662f4f798b50d8c8743f433842c3e40fe3378
https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=ba3021b2c79b2fa9114f92790a99deb27a65b728
Discussion:
Acknowledgm
arXiv
Understanding Concurrency Vulnerabilities in Linux Kernel
arxiv_fulltext·2022-12-11
Understanding Concurrency Vulnerabilities in Linux Kernel
Understanding Concurrency Vulnerabilities in Linux Kernel
Zunchen Huang
University of Southern California
Los Angeles, CA
USA
Shengjian Guo
Baidu Security
Sunnyvale, CA
USA
Meng Wu
Virginia Tech
Blacksburg, VA
USA
Chao Wang
University of Southern California
Los Angeles, CA
USA
## Abstract
While there is a large body of work on analyzing concurrency related
software bugs and developing techniques for detecting and patching
them, little attention has been given to concurrency related security
vulnerabilities. The two are different in that not all bugs are
vulnerabilities: for a bug to be exploitable, there needs be a way for
attackers to trigger its execution and cause damage, e.g., by
revealing sensitive data or running malicious code.
To fill the gap, we conduct the first empiri
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ba3021b2c79b2fa9114f92790a99deb27a65b728http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d11662f4f798b50d8c8743f433842c3e40fe3378http://www.debian.org/security/2017/dsa-3981http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5http://www.openwall.com/lists/oss-security/2017/06/12/2http://www.securityfocus.com/bid/99121https://access.redhat.com/errata/RHSA-2017:3295https://access.redhat.com/errata/RHSA-2017:3315https://access.redhat.com/errata/RHSA-2017:3322https://github.com/torvalds/linux/commit/ba3021b2c79b2fa9114f92790a99deb27a65b728https://github.com/torvalds/linux/commit/d11662f4f798b50d8c8743f433842c3e40fe3378https://source.android.com/security/bulletin/pixel/2017-12-01http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ba3021b2c79b2fa9114f92790a99deb27a65b728http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=d11662f4f798b50d8c8743f433842c3e40fe3378http://www.debian.org/security/2017/dsa-3981http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.11.5http://www.openwall.com/lists/oss-security/2017/06/12/2http://www.securityfocus.com/bid/99121https://access.redhat.com/errata/RHSA-2017:3295https://access.redhat.com/errata/RHSA-2017:3315https://access.redhat.com/errata/RHSA-2017:3322https://github.com/torvalds/linux/commit/ba3021b2c79b2fa9114f92790a99deb27a65b728https://github.com/torvalds/linux/commit/d11662f4f798b50d8c8743f433842c3e40fe3378https://source.android.com/security/bulletin/pixel/2017-12-01
2017-06-17
Published