CVE-2015-2041

Published: 23 February 2015

net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 uses an incorrect data type in a sysctl table, which allows local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry.

From the Ubuntu security team

An information leak was discovered in the Linux Kernel's handling of userspace configuration of the link layer control (LLC). A local user could exploit this flaw to read data from other sysctl settings.

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

introduced in https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=590232a7150674b2036291eaefce085f3f9659c8

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2041
• https://ubuntu.com/security/notices/USN-2560-1
• https://ubuntu.com/security/notices/USN-2561-1
• https://ubuntu.com/security/notices/USN-2562-1
• https://ubuntu.com/security/notices/USN-2563-1
• https://ubuntu.com/security/notices/USN-2564-1
• https://ubuntu.com/security/notices/USN-2565-1
• NVD
• Launchpad
• Debian

Bugs

• https://bugzilla.redhat.com/show_bug.cgi?id=1195350
• https://launchpad.net/bugs/1425271