CVE-2014-9904

High

Published: 27/06/2016(UTC)Translated: 15/06/2026(UTC)NVD NIST

Summary

The snd_compress_check_input function in the ALSA subsystem in the Linux kernel before version 3.17 does not properly check for integer overflow, which may lead to denial of service due to insufficient memory allocation or other unspecified impacts.

Risk Assessment

Local users may exploit this vulnerability to disrupt system operation, potentially leading to serious availability issues.

Recommendation

It is recommended to update the Linux kernel to version 3.17 or later to mitigate this vulnerability.

Other vulnerabilities in ALSA subsystem in the Linux kernel

CVE-2017-0861High
Use-after-free vulnerability in the snd_pcm_info function in the ALSA subsystem in the Linux kernel allows attackers to gain privileges via unspecified vectors.

Original NVD description (English source)

The snd_compress_check_input function in sound/core/compress_offload.c in the ALSA subsystem in the Linux kernel before 3.17 does not properly check for an integer overflow, which allows local users to cause a denial of service (insufficient memory allocation) or possibly have unspecified other impact via a crafted SNDRV_COMPRESS_SET_PARAMS ioctl call.