CVE-2015-7312

Published: 23 September 2015

Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.

From the Ubuntu Security Team

Ben Hutchings discovered that the Advanced Union Filesystem (aufs) for the Linux kernel did not correctly handle references of memory mapped files from an aufs mount. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code with administrative privileges.

Status

References

• http://www.openwall.com/lists/oss-security/2015/09/10/3
• http://sourceforge.net/p/aufs/mailman/message/34449209/
• https://ubuntu.com/security/notices/USN-2776-1
• https://ubuntu.com/security/notices/USN-2775-1
• https://ubuntu.com/security/notices/USN-2777-1
• https://ubuntu.com/security/notices/USN-2778-1
• https://ubuntu.com/security/notices/USN-2779-1
• https://www.cve.org/CVERecord?id=CVE-2015-7312
• NVD
• Launchpad
• Debian

Bugs

• http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=796036
• https://launchpad.net/bugs/1499612