CVE-2014-4655: Canonical Ubuntu Linux

Medium severity, CVSS 4.9. EPSS: 0.5% chance of exploitation in the next 30 days.

The snd_ctl_elem_add function in sound/core/control.c in the ALSA control implementation in the Linux kernel before 3.15.2 does not properly maintain the user_ctl_count value, which allows local users to cause a denial of service (integer overflow and limit bypass) by leveraging /dev/snd/controlCX access for a large number of SNDRV_CTL_IOCTL_ELEM_REPLACE ioctl calls.

Affected products

• Canonical Ubuntu Linux: version 12.04 only
• Linux Linux Kernel: before 3.15.2 (fixed in 3.15.2)
• Suse Linux Enterprise Server: version 10 only

Published 2014-07-03. Last modified 2026-06-17.