CVE-2014-4656 — Vulnetix

CVE-2014-4656 PUBLISHED

Multiple integer overflows in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 allow local users to cause a denial of service by leveraging /dev/snd/controlCX access, related to (1) index values in the snd_ctl_add function and (2) numid values in the snd_ctl_remove_numid_conflict function.

EPSS 0.08% · 22.8th percentile

Risk Scores

EPSS Score

0.08%

22.8th percentile

Affected Products

Vendor	Product	Versions
Ubuntu:22.04:LTS	linux-intel-iot-realtime	0, 5.15.0-1073.75
Ubuntu:18.04:LTS	linux-hwe	5.0.0-35.38~18.04.1, 5.0.0-37.40~18.04.1, 5.3.0-26.28~18.04.1
Ubuntu:24.04:LTS	linux-raspi-realtime	6.8.0-2019.20, 0
Ubuntu:14.04:LTS	linux	3.13.0-6.23, 3.13.0-7.25, 3.13.0-5.20
Ubuntu:Pro:20.04:LTS	linux-azure-fde-5.15	5.15.0-1102.111~20.04.1.1, *, 5.15.0-1034.41~20.04.1.2
Ubuntu:18.04:LTS	linux-gcp	4.15.0-1027.28, 4.15.0-1019.20, 4.15.0-1023.24
Ubuntu:24.04:LTS	linux-lowlatency-hwe-6.11	6.11.0-1011.12~24.04.1, 0, 6.11.0-1016.17~24.04.1
Ubuntu:20.04:LTS	linux-riscv	5.4.0-34.38, 5.4.0-37.42, 0
Ubuntu:20.04:LTS	linux-gke	5.4.0-1067.70, 5.4.0-1055.58, 5.4.0-1051.54
Ubuntu:22.04:LTS	linux-riscv	5.15.0-1008.8, 5.15.0-1005.5, 5.15.0-1004.4
Ubuntu:24.04:LTS	linux-gcp-6.11	0, *, 6.11.0-1017.17~24.04.1
Ubuntu:24.04:LTS	linux-hwe-6.11	6.11.0-17.17~24.04.2, 6.11.0-19.19~24.04.1, 6.11.0-21.21~24.04.1
Ubuntu:20.04:LTS	linux-azure-fde	, , 0
Ubuntu:24.04:LTS	linux-azure-6.11	6.11.0-1018.18~24.04.1, 6.11.0-1017.17~24.04.1, 6.11.0-1015.15~24.04.1
Ubuntu:18.04:LTS	linux-hwe-edge	5.0.0-15.16~18.04.1, 0, 5.3.0-24.26~18.04.2
Ubuntu:24.04:LTS	linux-riscv	6.8.0-40.40.1, 6.8.0-44.44.1, 6.8.0-47.47.1
Ubuntu:22.04:LTS	linux-realtime	0, 5.15.0-1032.35
Ubuntu:18.04:LTS	linux-azure	5.0.0-1022.23~18.04.1, 5.0.0-1023.24~18.04.1, 5.0.0-1025.27~18.04.1
Ubuntu:24.04:LTS	linux-realtime	6.8.1-1015.16, 0
Ubuntu:20.04:LTS	linux-raspi2	0, 5.3.0-1007.8, 5.3.0-1014.16

…and 1 more

Exploit Intelligence

Android Tethering Provisioning Check Bypass (CVE-2017-0554) (github-poc)
Android Tethering Provisioning Check Bypass (CVE-2017-0554) (github-poc)
Android Tethering Provisioning Check Bypass (CVE-2017-0554) (github-poc)
Android Tethering Provisioning Check Bypass (CVE-2017-0554) (github-poc)
Android Tethering Provisioning Check Bypass (CVE-2017-0554) (github-poc)

Timeline

Jul 3, 2014 CVE Published
Feb 4, 2022 EPSS Score
Mar 29, 2022 EPSS Score
May 20, 2022 EPSS Score
Jul 12, 2022 EPSS Score
Sep 3, 2022 EPSS Score
Oct 26, 2022 EPSS Score
Dec 18, 2022 EPSS Score
Feb 8, 2023 EPSS Score
Mar 7, 2023 EPSS Score
Apr 2, 2023 EPSS Score
May 25, 2023 EPSS Score

References

https://ubuntu.com/security/CVE-2014-4656 third-party-advisory
https://github.com/torvalds/linux/commit/ac902c112d90a89e59916f751c2745f4dbdbb4bd third-party-advisory
https://github.com/torvalds/linux/commit/883a1d49f0d77d30012f114b2e19fc141beb3e8e third-party-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1113470 third-party-advisory
http://www.openwall.com/lists/oss-security/2014/06/26/6 third-party-advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2 third-party-advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ac902c112d90a89e59916f751c2745f4dbdbb4bd third-party-advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=883a1d49f0d77d30012f114b2e19fc141beb3e8e third-party-advisory
https://ubuntu.com/security/notices/USN-2332-1 vendor-advisory
https://ubuntu.com/security/notices/USN-2333-1 vendor-advisory
https://ubuntu.com/security/notices/USN-2334-1 vendor-advisory
https://ubuntu.com/security/notices/USN-2335-1 vendor-advisory
https://ubuntu.com/security/notices/USN-2336-1 vendor-advisory
https://ubuntu.com/security/notices/USN-2337-1 vendor-advisory
https://www.cve.org/CVERecord?id=CVE-2014-4656 third-party-advisory

Open in Interactive Console →