CVE-2015-7872

Published: 16 November 2015

The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

From the Ubuntu Security Team

Dmitry Vyukov discovered that the Linux kernel's keyring handler attempted to garbage collect incompletely instantiated keys. A local unprivileged attacker could use this to cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Per the oss-security discussion and the author's commit notes,
911b79cde is not actually a security issue, so removed its break-fix.

Status

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1272371
• http://www.openwall.com/lists/oss-security/2015/10/20/5
• https://ubuntu.com/security/notices/USN-2823-1
• https://ubuntu.com/security/notices/USN-2824-1
• https://ubuntu.com/security/notices/USN-2826-1
• https://ubuntu.com/security/notices/USN-2829-1
• https://ubuntu.com/security/notices/USN-2829-2
• https://ubuntu.com/security/notices/USN-2843-1
• https://ubuntu.com/security/notices/USN-2840-1
• https://ubuntu.com/security/notices/USN-2843-2
• https://ubuntu.com/security/notices/USN-2843-3
• https://ubuntu.com/security/notices/USN-2840-2
• https://www.cve.org/CVERecord?id=CVE-2015-7872
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1508856