Red Hat Bugzilla – Bug 1311558
CVE-2016-2544 kernel: sound: use-after-free in snd_timer_stop
Last modified: 2017-01-19 11:17:48 EST
ALSA sequencer code has an open race between the timer setup ioctl and the close of the client. This was triggered by syzkaller fuzzer, and a use-after-free was caught there as a result. Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=3567eb6af614dac436c4b16a8d426f9faed639b3 External references: http://www.spinics.net/lists/alsa-devel/msg45102.html https://lkml.org/lkml/2016/1/12/465 CVE-ID request and assignment: http://seclists.org/oss-sec/2016/q1/133 http://seclists.org/oss-sec/2016/q1/410
This was fixed in 4.3.6 with: commit 5a5c8e77d66f24446b7e741ac2e3ae3127d9dd54 Author: Takashi Iwai <tiwai@suse.de> Date: Tue Jan 12 15:36:27 2016 +0100 ALSA: seq: Fix race at timer setup and close commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream. and in 4.4.2 with: commit 0058ede73e1f441c003666f61671dfddfcbd5811 Author: Takashi Iwai <tiwai@suse.de> Date: Tue Jan 12 15:36:27 2016 +0100 ALSA: seq: Fix race at timer setup and close commit 3567eb6af614dac436c4b16a8d426f9faed639b3 upstream. All Fedora branches are already on those or newer and should already contain the fix for this issue.
There were lots of CVE assignments for kernel vulnerabilities yesterday, just wanted to make sure Fedora has them. Feel free to close the tracker if they are all fixed. Thanks!
Statement: This issue affects the Linux kernel packages as shipped with Red Hat Enterprise Linux 5, 6, 7 and MRG-2. This has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata/.