Debian Security Advisory

DSA-1505-1 alsa-driver -- kernel memory leak

Date Reported:
22 Feb 2008
Affected Packages:
Security database references:
In Mitre's CVE dictionary: CVE-2007-4571.
More information:

Takashi Iwai supplied a fix for a memory leak in the snd_page_alloc module. Local users could exploit this issue to obtain sensitive information from the kernel (CVE-2007-4571).

For the oldstable distribution (sarge), this problem has been fixed in version 1.0.8-7sarge1. The prebuilt modules provided by alsa-modules-i386 have been rebuilt to take advantage of this update, and are available in version 1.0.8+2sarge2.

For the stable distribution (etch), this problem has been fixed in version 1.0.13-5etch1. This issue was already fixed for the version of ALSA provided by linux-2.6 in DSA 1479.

For the unstable distributions (sid), this problem was fixed in version 1.0.15-1.

We recommend that you upgrade your alsa-driver and alsa-modules-i386 packages.

Fixed in:

Debian GNU/Linux 3.1 (sarge)

Architecture-independent component:
Intel IA-32:

Debian GNU/Linux 4.0 (etch)

Architecture-independent component:

MD5 checksums of the listed files are available in the original advisory.