CVE-2015-2830

Published: 3 April 2015

arch/x86/kernel/entry_64.S in the Linux kernel before 3.19.2 does not prevent the TS_COMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.

From the Ubuntu Security Team

A privilege escalation was discovered in the fork syscall via the int80 entry on 64 bit kernels with 32 bit emulation support. An unprivileged local attacker could exploit this flaw to increase their privileges on the system.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-2830
• http://www.openwall.com/lists/oss-security/2015/04/02/1
• https://ubuntu.com/security/notices/USN-2589-1
• https://ubuntu.com/security/notices/USN-2590-1
• https://ubuntu.com/security/notices/USN-2613-1
• https://ubuntu.com/security/notices/USN-2614-1
• https://ubuntu.com/security/notices/USN-2631-1
• https://ubuntu.com/security/notices/USN-2632-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1440234