[linux] 01/01: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (CVE-2016-4569)

[debian-kernel at lists.debian.org]

This is an automated email from the git hooks/post-receive script.

carnil pushed a commit to branch jessie-security
in repository linux.

commit 912af459188a559e4f50841f95be902d5889b0fa
Author: Salvatore Bonaccorso <carnil at debian.org>
Date:   Thu Jun 23 21:23:42 2016 +0200

    ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (CVE-2016-4569)
---
 debian/changelog                                   |  1 +
 ...imer-fix-leak-in-sndrv_timer_ioctl_params.patch | 33 ++++++++++++++++++++++
 debian/patches/series                              |  1 +
 3 files changed, 35 insertions(+)

diff --git a/debian/changelog b/debian/changelog
index d3098e2..2fbc998 100644
--- a/debian/changelog
+++ b/debian/changelog
@@ -27,6 +27,7 @@ linux (3.16.7-ckt25-2+deb8u1) UNRELEASED; urgency=medium
   * propogate_mnt: Handle the first propogated copy being a slave
     (CVE-2016-4581)
   * USB: usbfs: fix potential infoleak in devio (CVE-2016-4482)
+  * ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS (CVE-2016-4569)
 
  -- Ben Hutchings <ben at decadent.org.uk>  Wed, 30 Mar 2016 16:32:07 +0100
 
diff --git a/debian/patches/bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch b/debian/patches/bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch
new file mode 100644
index 0000000..76407cc
--- /dev/null
+++ b/debian/patches/bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch
@@ -0,0 +1,33 @@
+From: Kangjie Lu <kangjielu at gmail.com>
+Date: Tue, 3 May 2016 16:44:07 -0400
+Subject: ALSA: timer: Fix leak in SNDRV_TIMER_IOCTL_PARAMS
+MIME-Version: 1.0
+Content-Type: text/plain; charset=UTF-8
+Content-Transfer-Encoding: 8bit
+Origin: https://git.kernel.org/linus/cec8f96e49d9be372fdb0c3836dcf31ec71e457e
+
+The stack object “tread” has a total size of 32 bytes. Its field
+“event” and “val” both contain 4 bytes padding. These 8 bytes
+padding bytes are sent to user without being initialized.
+
+Signed-off-by: Kangjie Lu <kjlu at gatech.edu>
+Signed-off-by: Takashi Iwai <tiwai at suse.de>
+---
+ sound/core/timer.c | 1 +
+ 1 file changed, 1 insertion(+)
+
+diff --git a/sound/core/timer.c b/sound/core/timer.c
+index 0cfc028..306a93d 100644
+--- a/sound/core/timer.c
++++ b/sound/core/timer.c
+@@ -1737,6 +1737,7 @@ static int snd_timer_user_params(struct file *file,
+ 	if (tu->timeri->flags & SNDRV_TIMER_IFLG_EARLY_EVENT) {
+ 		if (tu->tread) {
+ 			struct snd_timer_tread tread;
++			memset(&tread, 0, sizeof(tread));
+ 			tread.event = SNDRV_TIMER_EVENT_EARLY;
+ 			tread.tstamp.tv_sec = 0;
+ 			tread.tstamp.tv_nsec = 0;
+-- 
+2.8.1
+
diff --git a/debian/patches/series b/debian/patches/series
index 350c00c..c01d3a8 100644
--- a/debian/patches/series
+++ b/debian/patches/series
@@ -679,3 +679,4 @@ bugfix/all/get_rock_ridge_filename-handle-malformed-NM-entries.patch
 bugfix/all/fs-pnode.c-treat-zero-mnt_group_id-s-as-unequal.patch
 bugfix/all/propogate_mnt-Handle-the-first-propogated-copy-being.patch
 bugfix/all/usb-usbfs-fix-potential-infoleak-in-devio.patch
+bugfix/all/alsa-timer-fix-leak-in-sndrv_timer_ioctl_params.patch

-- 
Alioth's /usr/local/bin/git-commit-notice on /srv/git.debian.org/git/kernel/linux.git