CVE-2015-1420

Published: 16 March 2015

Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.

From the Ubuntu Security Team

A race condition was discovered in the Linux kernel's file_handle size verification. A local user could exploit this flaw to read potentially sensative memory locations.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1420
• http://marc.info/?l=linux-kernel&m=142247707318982&w=2
• https://ubuntu.com/security/notices/USN-2660-1
• https://ubuntu.com/security/notices/USN-2661-1
• https://ubuntu.com/security/notices/USN-2662-1
• https://ubuntu.com/security/notices/USN-2663-1
• https://ubuntu.com/security/notices/USN-2664-1
• https://ubuntu.com/security/notices/USN-2665-1
• https://ubuntu.com/security/notices/USN-2666-1
• https://ubuntu.com/security/notices/USN-2667-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1416503