CVE-2014-9904

What it actually does

The snd_compress_check_input function fails to validate parameters from a SNDRV_COMPRESS_SET_PARAMS ioctl, permitting an integer overflow that results in undersized memory allocation and subsequent memory corruption or denial of service.

Why it matters to the business

Local attackers on affected systems can crash audio-related processes or escalate privileges, leading to service disruption on servers or workstations that rely on ALSA compression offload; older unpatched distributions remain exposed despite the flaw's age.

How an attack unfolds

An attacker with local access crafts a malicious SNDRV_COMPRESS_SET_PARAMS ioctl containing oversized parameters that trigger the integer overflow in the ALSA compress offload path, causing the kernel to allocate insufficient memory and enabling follow-on corruption or crashes.

How to fix it

Upgrade the Linux kernel to version 3.17 or later; rebuild and reboot into the fixed kernel. Where immediate upgrade is impossible, restrict untrusted local accounts from accessing audio device nodes via permissions or seccomp filters.

How to confirm the fix worked

Run uname -r to confirm kernel version is 3.17 or newer; attempt to load the compress-offload module and exercise SNDRV_COMPRESS_SET_PARAMS with boundary values in a test environment to verify no overflow occurs.

Typical attack path

1. Obtain a local shell or process on the target system
2. Open /dev/snd/compress device node
3. Invoke SNDRV_COMPRESS_SET_PARAMS ioctl with crafted struct snd_compr_params containing overflow-triggering values
4. Trigger allocation failure or memory corruption to achieve denial of service or attempt privilege escalation

How to detect it

Review kernel logs (dmesg, /var/log/kern.log) for oops or panic messages containing snd_compress_check_input or compress_offload; correlate with audit logs showing unusual ioctl calls on audio devices by non-privileged users.

What your security team should do

• Prioritize kernel upgrades on any remaining systems still running kernels older than 3.17
• Audit local user access to /dev/snd/* nodes and apply least-privilege controls
• Monitor for kernel oops or panic logs referencing compress_offload.c