FPII-2320: Elevation of privilege vulnerability in kernel USB driver CVE-2014-4655 A-29916012
The snd_ctl_elem_add function in sound/core/control.c file, in the ALSA control implementation in the Linux kernel before 3.15.2, does not properly maintain the user_ctl_count value, which allows local users to execute code in the kernel by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.
The fix is designed to use the snd_ctl_remove_user_ctl function, which does
proper permission checks and decrements user_ctl_count after the control
Change-Id: Id8ba70327eb6723d6528d2a1793d6f4e9b475d51
1 file changed