CVE-2015-7990

Published: 28 December 2015

Race condition in the rds_sendmsg function in net/rds/sendmsg.c in the Linux kernel before 4.3.3 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact by using a socket that was not properly bound. NOTE: this vulnerability exists because of an incomplete fix for CVE-2015-6937.

From the Ubuntu Security Team

Sasha Levin discovered that the Reliable Datagram Sockets (RDS) implementation in the Linux kernel had a race condition when checking whether a socket was bound or not. A local attacker could use this to cause a denial of service (system crash).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

denial of service through kernel NPE

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7990
• https://lkml.org/lkml/2015/10/16/530
• http://www.openwall.com/lists/oss-security/2015/10/27/5
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• https://ubuntu.com/security/notices/USN-2889-2
• https://ubuntu.com/security/notices/USN-2889-1
• https://ubuntu.com/security/notices/USN-2887-1
• https://ubuntu.com/security/notices/USN-2887-2
• https://ubuntu.com/security/notices/USN-2888-1
• https://ubuntu.com/security/notices/USN-2890-1
• https://ubuntu.com/security/notices/USN-2890-2
• https://ubuntu.com/security/notices/USN-2890-3
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1510805