NetBSD 'azalia(4)' and 'hdaudio(4)' Kernel Local Denial of Service Vulnerabilities

Bugtraq ID:	38057
Class:	Input Validation Error
CVE:	CVE-2010-0561
Remote:	No
Local:	Yes
Published:	Feb 03 2010 12:00AM
Updated:	Apr 13 2015 09:02PM
Credit:	Pierre Pronchery
Vulnerable:	NetBSD NetBSD 5.0.1 NetBSD NetBSD 4.0.2 NetBSD NetBSD 4.0.1 NetBSD NetBSD Current NetBSD NetBSD 5.0 RC3 NetBSD NetBSD 5.0 NetBSD NetBSD 4.1 NetBSD NetBSD 4.0
Not Vulnerable:

NetBSD 'azalia(4)' and 'hdaudio(4)' Kernel Local Denial of Service Vulnerabilities

The NetBSD kernel is prone to multiple local denial-of-service vulnerabilities because it fails to properly verify signedness of a user-supplied value.

Attackers can exploit these issues to cause the kernel to crash, denying service to legitimate users. Given the nature of these issues, attackers may also be able to execute arbitrary code, but this has not been confirmed.

NetBSD 'azalia(4)' and 'hdaudio(4)' Kernel Local Denial of Service Vulnerabilities

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

NetBSD 'azalia(4)' and 'hdaudio(4)' Kernel Local Denial of Service Vulnerabilities

Solution:
Updates are available. Please see the references for more information.

NetBSD 'azalia(4)' and 'hdaudio(4)' Kernel Local Denial of Service Vulnerabilities

References:

• NetBSD Homepage (NetBSD)
  
• NetBSD Security Advisory 2010-003 azalia(4)/hdaudio(4) negative mixer index pani (NetBSD)