Main Vulnerability Database Vulnerabilities #VU93726

Buffer overflow in Linux kernel - CVE-2007-4571

Published: September 26, 2007 / Updated: July 3, 2024

Vulnerability identifier: #VU93726

CSH Severity: Low

CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]

CVE-ID: CVE-2007-4571

CWE-ID: CWE-119

Exploitation vector: Local access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a local user to gain access to sensitive information.

The snd_mem_proc_read function in sound/core/memalloc.c in the Advanced Linux Sound Architecture (ALSA) in the Linux kernel before 2.6.22.8 does not return the correct write size, which allows local users to obtain sensitive information (kernel memory contents) via a small count argument, as demonstrated by multiple reads of /proc/driver/snd-page-alloc.

Affected software

Linux kernel

How to mitigate CVE-2007-4571

Install update from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #10151 - Linux Kernel 2.6.x - ALSA snd-page-alloc Local Proc File Information Disclosure (July 3, 2024)

External References

Related Security Bulletins

Buffer overflow in Linux kernel