992731 – (CVE-2014-9892) VUL-1: CVE-2014-9892: kernel: snd_compr_tstamp through 4.7 infoleak

Bug 992731 (CVE-2014-9892) - VUL-1: CVE-2014-9892: kernel: snd_compr_tstamp through 4.7 infoleak

Summary: VUL-1: CVE-2014-9892: kernel: snd_compr_tstamp through 4.7 infoleak

Status:	RESOLVED INVALID

Alias:	CVE-2014-9892

Product:	SUSE Security Incidents
Classification:	Novell Products
Component:	Incidents (show other bugs)
Version:	unspecified
Hardware:	Other Other

Priority:	P4 - Low Severity: Normal
Target Milestone:	---
Assignee:	Security Team bot
QA Contact:	Security Team bot

URL:	https://smash.suse.de/issue/171732/
Whiteboard:
Keywords:

Depends on:
Blocks:

Clone This Bug

Reported:	2016-08-09 07:24 UTC by Sebastian Krahmer
Modified:	2016-08-10 12:25 UTC (History)
CC List:	4 users (show)

See Also:
Found By:	Security Response Team
Services Priority:
Business Priority:
Blocker:	---
Marketing QA Status:	---
IT Deployment:	---

Attachments
Add an attachment (proposed patch, testcase, etc.)

Note You need to log in before you can comment on or make changes to this bug.

Description Sebastian Krahmer 2016-08-09 07:24:13 UTC

CVE-2014-9892



References:
http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2014-9892
http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9892

Comment 1 Takashi Iwai 2016-08-09 08:04:54 UTC

It doesn't hit to any already released products.  Only TW, SLE12-SP2 and openSUSE-42.2 kernels enable CONFIG_SND_COMPRESS_OFFLOAD.

Comment 2 Takashi Iwai 2016-08-09 08:40:08 UTC

And the issue has been fixed in upstream by commit
17ac8e5c6d3478dcfeb75ed5716ca7e5cee612f0
    ALSA: core: don't return uninitialized snd_compr_tstamp

which is included in 3.9 kernel.   So all our products are fine.

Comment 3 Takashi Iwai 2016-08-10 05:51:56 UTC

Reassigned back to security team.

Comment 4 Sebastian Krahmer 2016-08-10 07:00:05 UTC

Thanks, closing as INVALID.