CVE-2015-5697

Published: 31 August 2015

The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.

From the Ubuntu security team

Benjamin Randazzo discovered an information leak in the md (multiple device) driver when the bitmap_info.file is disabled. A local privileged attacker could use this to obtain sensitive information from the kernel.

Notes

Author	Note
jdstrand	android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.10 and earlier preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support

Author

Note

jdstrand

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
	Patches: Introduced by 1da177e4c3f41524e886b7f1b8a0c1fc7321cac2 Fixed by b6878d9e03043695dbf3fa1caa6dfc09db225b16
linux-2.6 Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-armadaxp Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
	This package is not directly supported by the Ubuntu Security Team
linux-aws Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-ec2 Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-flo Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-gke Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-goldfish Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-grouper Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-hwe Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-hwe-edge Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-linaro-omap Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-linaro-shared Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-linaro-vexpress Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-quantal Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
	This package is not directly supported by the Ubuntu Security Team
linux-lts-raring Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-saucy Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
	This package is not directly supported by the Ubuntu Security Team
linux-lts-trusty Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-utopic Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-vivid Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-wily Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-lts-xenial Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-maguro Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-mako Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-manta Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-mvl-dove Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-qcm-msm Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-raspi2 Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-snapdragon Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)
linux-ti-omap4 Launchpad, Ubuntu, Debian	upstream	Released (4.2~rc6)

References

Bugs

https://launchpad.net/bugs/1481039

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM ›

Security