CVE-2015-8569

Published: 28 December 2015

The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.

From the Ubuntu Security Team

Dmitry Vyukov discovered that the pptp implementation in the Linux kernel did not verify an address length when setting up a socket. A local attacker could use this to craft an application that exposed sensitive information from kernel memory.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

pptp: verify sockaddr_len in pptp_bind() and pptp_connect()

Status

Severity score breakdown

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8569
• http://www.openwall.com/lists/oss-security/2015/12/15/7
• https://twitter.com/grsecurity/status/676744240802750464
• https://lkml.org/lkml/2015/12/14/252
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• https://ubuntu.com/security/notices/USN-2888-1
• https://ubuntu.com/security/notices/USN-2890-1
• https://ubuntu.com/security/notices/USN-2890-2
• https://ubuntu.com/security/notices/USN-2890-3
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2907-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1526958