Bugzilla – Bug 1046599
VUL-1: CVE-2017-9984: kernel: DoS in snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c
Last modified: 2019-05-29 07:48:44 UTC
CVE-2017-9984 The snd_msnd_interrupt function in sound/isa/msnd/msnd_pinnacle.c in the Linux kernel through 4.11.7 allows local users to cause a denial of service (over-boundary access) or possibly have unspecified other impact by changing the value of a message queue head pointer between two kernel reads of that value, aka a "double fetch" vulnerability. References: http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2017-9984 http://people.canonical.com/~ubuntu-security/cve/2017/CVE-2017-9984.html http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-9984 https://bugzilla.kernel.org/show_bug.cgi?id=196131
Sigh, again yet another security report where the upstream maintainer was never informed...
It's about legacy ISA driver, so only SLE11 or older are affected.
... and it's no supported module, so SLE11 Server isn't affected.
IMO, this is no real security issue. The DoS is possibly only with a flawed hardware that gives a wrong io-port read. And if you assume that level of hardware trickery, everything can be done. And, needless to say that the issue is specific to the ISA sound card, and practically seen it hits no one.
So I push back this as WONTFIX as a non-security issue. I'm going to address it in the upstream, but it's not worth for backporting.
oki