Linux Kernel snd_seq_oss_open () function Multiple Local Memory Corruption Vulnerabilities

Release date: 2010-09-08
Updated on: 2010-09-09

Affected Systems:
Linux kernel 2.6.x
Description:
--------------------------------------------------------------------------------
Bugtraq id: 43062
Cve id: CVE-2010-3080

Linux Kernel is the Kernel used by open source Linux.

The snd_seq_oss_open function in the sound/core/seq/oss/seq_oss_init.c file of Linux Kernel has the Memory Corruption Vulnerability. The following are error paths for failed creation:

_ Error:
Snd_seq_oss_writeq_delete (dp-> writeq );
Snd_seq_oss_readq_delete (dp-> readq );
Snd_seq_oss_synth_cleanup (dp );
Snd_seq_oss_midi_cleanup (dp );
Delete_port (dp );
Delete_seq_queue (dp-> queue );
Kfree (dp );

The port_delete called by delete_port executes free_devinfo on the seq_oss_devinfo structure (about 269 rows in seq_ports.c ):

If (port-> private_free)
Port-> private_free (port-> private_data );

Because of the following code (about 334 lines in the seq_oss_init.c file ):

Memset (& callback, 0, sizeof (callback ));
Callback. owner = THIS_MODULE;
Callback. private_data = dp;
Callback. event_input = snd_seq_oss_event_input;
Callback. private_free = free_devinfo;
Port. kernel = & callback;

Executed:

Static void
Free_devinfo (void * private)
{
Struct seq_oss_devinfo * dp = (struct seq_oss_devinfo *) private;

If (dp-> timer)
Snd_seq_oss_timer_delete (dp-> timer );

If (dp-> writeq)
Snd_seq_oss_writeq_delete (dp-> writeq );

If (dp-> readq)
Snd_seq_oss_readq_delete (dp-> readq );

Kfree (dp );
}

Therefore:

Delete_port (dp );
Delete_seq_queue (dp-> queue); <= reference released pointer
Kfree (dp); <= Double release

<* Source: Tavis Ormandy (taviso@gentoo.org)

Link: https://bugzilla.redhat.com/show_bug.cgi? Format = multiple & amp; id = 630551
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linux
-----
The vendor has released a patch to fix this security problem. Please download it from the vendor's homepage:

Http://git.kernel.org /? P = linux/kernel/git/tiwai/sound-2.6.git; a = commitdiff; h = c598337660c21c0afaa9df5a65bb4a7a0cf15be8