lkml.org 
[lkml]   [2017]   [Dec]   [5]   [last100]   RSS Feed
Views: [wrap][no wrap]   [headers]  [forward] 
 
Messages in this thread
    /
    Date
    From
    SubjectRe: [PATCH] ALSA: pcm: prevent UAF in snd_pcm_info
    On Tue, 05 Dec 2017 20:29:07 +0100,
    Kees Cook wrote:
    >
    > On Tue, Dec 5, 2017 at 11:14 AM, Takashi Iwai <tiwai@suse.de> wrote:
    > > On Tue, 05 Dec 2017 18:16:55 +0100,
    > > Nick Desaulniers wrote:
    > >>
    > >> From: Robb Glasser <rglasser@google.com>
    > >>
    > >> When the device descriptor is closed, the `substream->runtime` pointer
    > >> is freed. But another thread may be in the ioctl handler, case
    > >> SNDRV_CTL_IOCTL_PCM_INFO. This case calls snd_pcm_info_user() which
    > >> calls snd_pcm_info() which accesses the now freed `substream->runtime`.
    > >>
    > >> Signed-off-by: Robb Glasser <rglasser@google.com>
    > >> Signed-off-by: Nick Desaulniers <ndesaulniers@google.com>
    > >
    > > Looks reasonable. Applied with Cc to stable now.
    >
    > FWIW, this was assigned CVE-2017-0861. (Best to get it into the commit
    > log if possible.)

    OK, I updated the changelog. Thanks for information.


    Takashi

    \
     
     \ /
      Last update: 2017-12-05 23:31    [W:4.064 / U:1.788 seconds]
    ©2003-2020 Jasper Spaans|hosted at Digital Ocean and TransIP|Read the blog|Advertise on this site