Description
The OSS code for the Sound Blaster (sb16) driver in Linux 2.4.x before 2.4.26, when operating in 16 bit mode, does not properly handle certain sample sizes, which allows local users to cause a denial of service (crash) via a sample with an odd number of bytes.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 3.0 | kernel-image-2.4.17-hppa | 32.4 | DSA-480 |
| Debian 3.0 | kernel-image-2.4.17-ia64 | 011226.17 | DSA-481 |
| Debian 3.0 | kernel-image-2.4.17-s390 +1 | 2.4.17-2.woody.4 | DSA-482 |
| Debian 3.0 | kernel-image-2.4.18-1-alpha | 2.4.18-15 | DSA-479 |
| Debian 3.0 | kernel-image-2.4.18-1-i386 | 2.4.18-13 | DSA-479 |
| Debian 3.0 | kernel-image-2.4.18-hppa | 62.3 | DSA-480 |
| Debian 3.0 | kernel-image-2.4.18-i386bf | 2.4.18-5woody8 | DSA-479 |
| Debian 3.0 | kernel-patch-2.4.16-arm +3 | 20040419 | DSA-495 |
| Debian 3.0 | kernel-patch-2.4.17-apus | 2.4.17-5 | DSA-482 |
| Debian 3.0 | kernel-patch-2.4.17-mips +1 | 2.4.17-0.020226.2.woody6 | DSA-489 |
| Debian 3.0 | kernel-patch-2.4.18-powerpc | 2.4.18-1woody5 | DSA-479 |
| Debian 3.0 | kernel-patch-2.4.19-mips | 2.4.19-0.020911.1.woody4 | DSA-491 |
| Debian 3.0 | kernel-source-2.4.16 | 2.4.16-1woody2 | DSA-495 |
| Debian 3.0 | kernel-source-2.4.17 | 2.4.17-1woody3 | DSA-489, DSA-482 |
| Debian 3.0 | kernel-source-2.4.18 | 2.4.18-14.3 | DSA-479 |
| Debian 3.0 | kernel-source-2.4.19 | 2.4.19-4.woody2 | DSA-491 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 3 | kernel +8 | 2.4.21-15.0.4.EL | RHSA-2004:413 |
Advisories 8
- RHSA-2004:413 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- DSA-491 linux-kernel-2.4.19-mips - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-482 linux-kernel-2.4.17-apus+s390 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-480 linux-kernel-2.4.17+2.4.18-hppa - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-479 linux-kernel-2.4.18-alpha+i386+powerpc - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-495 linux-kernel-2.4.16-arm - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-481 linux-kernel-2.4.17-ia64 - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-489 linux-kernel-2.4.17-mips+mipsel - several vulnerabilities Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2004:413 vendor-advisory
- O-127 third-party-advisory government-resource
- http://linux.bkbits.net:8080/linux-2.4/cset%40404ce5967rY2Ryu6Z_uNbYh643wuFA
- oval:org.mitre.oval:def:9427 vdb-entry signature
- DSA-482 vendor-advisory
- RHSA-2004:437 vendor-advisory
- DSA-495 vendor-advisory
- DSA-479 vendor-advisory
- DSA-480 vendor-advisory
- CLA-2004:846 vendor-advisory
- DSA-489 vendor-advisory
- DSA-481 vendor-advisory
- 9985 vdb-entry
- O-121 third-party-advisory government-resource
- linux-sound-blaster-dos(15868) vdb-entry
- O-193 third-party-advisory government-resource
- MDKSA-2004:029 vendor-advisory
- GLSA-200407-02 vendor-advisory
- DSA-491 vendor-advisory