CVE-2015-1593

Published: 16 March 2015

The stack randomization feature in the Linux kernel before 3.19.1 on 64-bit platforms uses incorrect data types for the results of bitwise left-shift operations, which makes it easier for attackers to bypass the ASLR protection mechanism by predicting the address of the top of the stack, related to the randomize_stack_top function in fs/binfmt_elf.c and the stack_maxrandom_size function in arch/x86/mm/mmap.c.

From the Ubuntu security team

An integer overflow was discovered in the stack randomization feature of the Linux kernel on 64 bit platforms. A local attacker could exploit this flaw to bypass the Address Space Layout Randomization (ASLR) protection mechanism.

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1593
• http://www.openwall.com/lists/oss-security/2015/02/13/13
• http://hmarco.org/bugs/linux-ASLR-integer-overflow.html
• http://hmarco.org/bugs/patches/fix_randomize_stack_top_properly_linux_3-17.1.patch
• https://usn.ubuntu.com/usn/usn-2560-1
• https://usn.ubuntu.com/usn/usn-2561-1
• https://usn.ubuntu.com/usn/usn-2562-1
• https://usn.ubuntu.com/usn/usn-2563-1
• https://usn.ubuntu.com/usn/usn-2564-1
• https://usn.ubuntu.com/usn/usn-2565-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1423757