CVE-2015-7799

Published: 19 October 2015

The slhc_init function in drivers/net/slip/slhc.c in the Linux kernel through 4.2.3 does not ensure that certain slot numbers are valid, which allows local users to cause a denial of service (NULL pointer dereference and system crash) via a crafted PPPIOCSMAXCID ioctl call.

From the Ubuntu Security Team

郭永刚 discovered that the ppp implementation in the Linux kernel did not ensure that certain slot numbers are valid. A local attacker with the privilege to call ioctl() on /dev/ppp could cause a denial of service (system crash).

Notes

/dev/ppp is only writable by root in Ubuntu

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7799
• http://www.openwall.com/lists/oss-security/2015/10/09/1
• https://code.google.com/p/android/issues/detail?id=187973
• https://ubuntu.com/security/notices/USN-2841-2
• https://ubuntu.com/security/notices/USN-2841-1
• https://ubuntu.com/security/notices/USN-2843-1
• https://ubuntu.com/security/notices/USN-2842-1
• https://ubuntu.com/security/notices/USN-2842-2
• https://ubuntu.com/security/notices/USN-2844-1
• https://ubuntu.com/security/notices/USN-2843-2
• https://ubuntu.com/security/notices/USN-2843-3
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1508329