CVE-2015-8785

Published: 31 December 2015

The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.

From the Ubuntu Security Team

It was discovered that the Linux kernel's Filesystem in Userspace (FUSE) implementation did not handle initial zero length segments properly. A local attacker could use this to cause a denial of service (unkillable task).

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Priority

Medium

CVSS 3 base score: 6.2

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8785
• https://bugzilla.redhat.com/show_bug.cgi?id=1290642
• http://www.openwall.com/lists/oss-security/2016/01/24/1
• https://ubuntu.com/security/notices/USN-2886-1
• https://ubuntu.com/security/notices/USN-2886-2
• https://ubuntu.com/security/notices/USN-2910-1
• https://ubuntu.com/security/notices/USN-2908-3
• https://ubuntu.com/security/notices/USN-2908-1
• https://ubuntu.com/security/notices/USN-2907-1
• https://ubuntu.com/security/notices/USN-2909-1
• https://ubuntu.com/security/notices/USN-2907-2
• https://ubuntu.com/security/notices/USN-2908-2
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1538425