In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: us122l: Prevent write upgrades for read mappings<\/p>\n
The hwdep mmap callback rejects read-buffer mappings that are initially
\nwritable, but leaves VM_MAYWRITE set on mappings created with PROT_READ.
\nA process that can open the hwdep node O_RDWR can later use mprotect() to
\nmake the mapping writable.<\/p>\n
The read allocation begins with struct usb_stream. Its read_size member is
\nused by the fault handler to decide which pages belong to the read buffer.
\nThe read VMA intentionally remains expandable because pcm_usb_stream uses
\nmremap() after reading that size. Changing read_size first can therefore
\nmap and access pages beyond the allocation. The same member is also
\nconsumed by usb_stream_free(), where changing it can make
\nfree_pages_exact() release pages outside the allocation.<\/p>\n
Clear VM_MAYWRITE for read-buffer mappings after rejecting an initially
\nwritable VMA. This keeps the separate output-buffer mapping writable while
\npreventing later permission upgrades.<\/p>\n","protected":false},"excerpt":{"rendered":"
In the Linux kernel, the following vulnerability has been resolved:<\/p>\n
ALSA: us122l: Prevent write upgrades for read mappings<\/p>\n
The hwdep mmap callback rejects read-buffer mappings that are initially
\nwri<\/p>\n","protected":false},"template":"","meta":[],"categories":[],"tags":[],"class_list":["post-29087","vuln","type-vuln","status-publish","hentry"],"_links":{"self":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln\/29087","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/vuln"}],"about":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=\/wp\/v2\/types\/vuln"}],"wp:attachment":[{"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=29087"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=29087"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.54iter.cn\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=29087"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}