CVE-2015-8575

Published: 17 December 2015

The sco_sock_bind function in net/bluetooth/sco.c in the Linux kernel before 4.3.4 does not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.

From the Ubuntu Security Team

David Miller discovered that the Bluetooth implementation in the Linux kernel did not properly validate the socket address length for Synchronous Connection-Oriented (SCO) sockets. A local attacker could use this to expose sensitive information.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Medium

CVSS 3 base score: 4.0

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8575
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• https://ubuntu.com/security/notices/USN-2888-1
• https://ubuntu.com/security/notices/USN-2890-1
• https://ubuntu.com/security/notices/USN-2890-2
• https://ubuntu.com/security/notices/USN-2890-3
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2907-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1530407