CVE-2007-4571

Description

The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count argument, as demonstrated by multiple reads of /proc/driver/snd-page-alloc.

2.1

CVSS

Severity: Low

CVSS 2.0 •

EPSS 0.13%

Vendor Advisory novell.com Vendor Advisory ubuntu.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory redhat.com Vendor Advisory redhat.com Vendor Advisory debian.org Vendor Advisory redhat.com

Affected: n/a n/a

References

Link	Tags
http://secunia.com/advisories/27747	third party advisory
http://secunia.com/advisories/27227	third party advisory
http://www.novell.com/linux/security/advisories/2007_53_kernel.html	vendor advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ccec6e2c4a74adf76ed4e2478091a311b1806212
http://www.securitytracker.com/id?1018734	vdb entry
http://www.ubuntu.com/usn/usn-618-1	vendor advisory
http://www.redhat.com/support/errata/RHSA-2007-0939.html	vendor advisory
http://www.vupen.com/english/advisories/2007/3272	vdb entry
http://secunia.com/advisories/28626	third party advisory
http://secunia.com/advisories/29054	third party advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A9053	vdb entry signature
http://www.debian.org/security/2008/dsa-1479	vendor advisory
https://www.redhat.com/archives/fedora-package-announce/2007-September/msg00436.html	vendor advisory
http://secunia.com/advisories/27824	third party advisory
http://www.securityfocus.com/bid/25807	vdb entry
http://secunia.com/advisories/26989	third party advisory
http://support.avaya.com/elmodocs2/security/ASA-2007-474.htm
http://kernel.org/pub/linux/kernel/v2.6/ChangeLog-2.6.22.8
http://www.redhat.com/support/errata/RHSA-2007-0993.html	vendor advisory
https://issues.rpath.com/browse/RPL-1761
http://secunia.com/advisories/26980	third party advisory
http://www.debian.org/security/2008/dsa-1505	vendor advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/36780	vdb entry
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=600	third party advisory
http://secunia.com/advisories/30769	third party advisory
http://secunia.com/advisories/27101	third party advisory
https://www.redhat.com/archives/fedora-package-announce/2007-October/msg00083.html	vendor advisory
http://secunia.com/advisories/27436	third party advisory
http://secunia.com/advisories/26918	third party advisory

Frequently Asked Questions

What is the severity of CVE-2007-4571?: CVE-2007-4571 has been scored as a low severity vulnerability.
How to fix CVE-2007-4571?: To fix CVE-2007-4571, make sure you are using an up-to-date version of the affected component(s) by checking the vendor release notes. As for now, there are no other specific guidelines available.
Is CVE-2007-4571 being actively exploited in the wild?: As for now, there are no information to confirm that CVE-2007-4571 is being actively exploited. According to its EPSS score, there is a ~0% probability that this vulnerability will be exploited by malicious actors in the next 30 days.