CVE-2011-1169

Error de índice de array en la función asihpi_hpi_ioctl de sound/pci/asihpi/hpioctl.c del controlador AudioScience HPI del kernel de Linux en versiones anteriores a 2.6.38.1. Puede permitir a usuarios locales provocar una denegación de servicio (corrupción de memoria) o posiblemente escalar privilegios a través de un valor de índice de adaptador modificado que provoca el acceso a un puntero del kernel inválido.

Dan Rosenberg discovered that IRDA did not correctly check the size of buffers. On non-x86 systems, a local attacker could exploit this to read kernel heap memory, leading to a loss of privacy. Dan Rosenburg discovered that the CAN subsystem leaked kernel addresses into the /proc filesystem. A local attacker could use this to increase the chances of a successful memory corruption exploit. Kees Cook discovered that the IOWarrior USB device driver did not correctly check certain size fields. A local attacker with physical access could plug in a specially crafted USB device to crash the system or potentially gain root privileges. Various other issues were also addressed.