CVE-2015-8575

Published: 17 December 2015

The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.

From the Ubuntu security team

David Miller discovered that the Bluetooth implementation in the Linux kernel did not properly validate the socket address length for Synchronous Connection-Oriented (SCO) sockets. A local attacker could use this to expose sensitive information.

Priority

Medium

CVSS 3 base score: 4.0

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8575
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• https://ubuntu.com/security/notices/USN-2888-1
• https://ubuntu.com/security/notices/USN-2890-1
• https://ubuntu.com/security/notices/USN-2890-2
• https://ubuntu.com/security/notices/USN-2890-3
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2907-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1530407