CVE-2010-4527

The load_mixer_volumes function in sound/oss/soundcard.c in the OSS sound subsystem in the Linux kernel before 2.6.37 incorrectly expects that a certain name field ends with a '\0' character, which allows local users to conduct buffer overflow attacks and gain privileges, or possibly obtain sensitive information from kernel memory, via a SOUND_MIXER_SETLEVELS ioctl call.

From the Ubuntu Security Team

Dan Rosenberg discovered that the OSS subsystem did not handle name termination correctly. A local attacker could exploit this crash the system or gain root privileges.

Read the notes from the security team

Status

Show unmaintained releases

Package	Ubuntu Release	Status
linux	11.04 natty	Fixed 2.6.37-12.26
	10.10 maverick	Fixed 2.6.35-27.47
	10.04 LTS lucid	Fixed 2.6.32-29.57
	9.10 karmic	Ignored
	8.04 LTS hardy	Fixed 2.6.24-29.89
	6.06 LTS dapper	Not in release
linux-ec2	11.04 natty	Not in release
	10.10 maverick	Ignored end of life
	10.04 LTS lucid	Fixed 2.6.32-313.25
	9.10 karmic	Ignored end of life
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-fsl-imx51	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Fixed 2.6.31-609.26
	9.10 karmic	Ignored end of life
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-lts-backport-maverick	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Fixed 2.6.35-28.50~lucid1
	9.10 karmic	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-lts-backport-natty	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not affected
	8.04 LTS hardy	Not in release
linux-mvl-dove	11.04 natty	Not in release
	10.10 maverick	Fixed 2.6.32-414.30
	10.04 LTS lucid	Fixed 2.6.32-214.30
	9.10 karmic	Ignored end of life
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release
linux-source-2.6.15	11.04 natty	Not in release
	10.10 maverick	Not in release
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Fixed 2.6.15-57.96
linux-ti-omap4	11.04 natty	Not affected
	10.10 maverick	Fixed 2.6.35-903.22
	10.04 LTS lucid	Not in release
	9.10 karmic	Not in release
	8.04 LTS hardy	Not in release
	6.06 LTS dapper	Not in release

Notes

jdstrand

in sound system. Dapper desktop is EOL so ignoring

Patch details

For informational purposes only. We recommend not to cherry-pick updates. How can I get the fixes?

Package	Patch details
linux	Upstream: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=d81a12bc29ae4038770e05dce4ab7f26fd5880fb

References

Related Ubuntu Security Notices (USN)

USN-1080-1
Linux kernel vulnerabilities
1 March 2011

USN-1080-2
Linux kernel vulnerabilities
2 March 2011

USN-1164-1
Linux kernel vulnerabilities (i.MX51)
6 July 2011

USN-1133-1
Linux kernel vulnerabilities
24 May 2011

USN-1111-1
Linux kernel vulnerabilities
5 May 2011

USN-1081-1
Linux kernel vulnerabilities
2 March 2011

USN-1187-1
Linux kernel (Maverick backport) vulnerabilities
9 August 2011

USN-1119-1
Linux kernel (OMAP4) vulnerabilities
20 April 2011