tree 5d3d6de62eeddfb157c81da666f1ac83ca6d3d36
parent 158d8994a55f441db630d47b8c2b72dd20126b97
author Teow Wan Yee <wy.teow@hi-p.com> 1472190209 +0800
committer Teemu Hukkanen <teemu@fairphone.com> 1474461018 +0200

FPII-2320: Elevation of privilege vulnerability in kernel USB driver CVE-2014-4655 A-29916012

The snd_ctl_elem_add function in sound/core/control.c file, in the ALSA control implementation in the Linux kernel before 3.15.2, does not properly maintain the user_ctl_count value, which allows local users to execute code in the kernel by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.
The fix is designed to use the snd_ctl_remove_user_ctl function, which does

proper permission checks and decrements user_ctl_count after the control

Change-Id: Id8ba70327eb6723d6528d2a1793d6f4e9b475d51