CVE-2015-8785
Published: 31 December 2015
The fuse_fill_write_pages function in fs/fuse/file.c in the Linux kernel before 4.4 allows local users to cause a denial of service (infinite loop) via a writev system call that triggers a zero length for the first segment of an iov.
From the Ubuntu security team
It was discovered that the Linux kernel's Filesystem in Userspace (FUSE) implementation did not handle initial zero length segments properly. A local attacker could use this to cause a denial of service (unkillable task).
Priority
Medium
CVSS 3 base score: 6.2
Status
| Package | Release | Status |
|---|---|---|
|
linux Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
Patches: Introduced by ea9b9907b82a09bd1a708004454f7065de77c5b0 Fixed by 3ca8138f014a913f98e6ef40e939868e1e9ea876 |
||
|
linux-2.6 Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-armadaxp Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
| This package is not directly supported by the Ubuntu Security Team | ||
|
linux-aws Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-flo Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-fsl-imx51 Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-gke Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-goldfish Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-grouper Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-hwe Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-hwe-edge Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-linaro-omap Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-linaro-shared Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-linaro-vexpress Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-quantal Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
| This package is not directly supported by the Ubuntu Security Team | ||
|
linux-lts-raring Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-saucy Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
| This package is not directly supported by the Ubuntu Security Team | ||
|
linux-lts-trusty Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-utopic Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-vivid Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-wily Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-lts-xenial Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-maguro Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-mako Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-manta Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-qcm-msm Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-snapdragon Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
|
linux-ti-omap4 Launchpad, Ubuntu, Debian |
Upstream |
Released
(4.4~rc5)
|
Notes
| Author | Note |
|---|---|
| jdstrand | android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.10 and earlier preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support |
References
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8785
- https://bugzilla.redhat.com/show_bug.cgi?id=1290642
- http://www.openwall.com/lists/oss-security/2016/01/24/1
- https://ubuntu.com/security/notices/USN-2886-1
- https://ubuntu.com/security/notices/USN-2886-2
- https://ubuntu.com/security/notices/USN-2910-1
- https://ubuntu.com/security/notices/USN-2908-3
- https://ubuntu.com/security/notices/USN-2908-1
- https://ubuntu.com/security/notices/USN-2907-1
- https://ubuntu.com/security/notices/USN-2909-1
- https://ubuntu.com/security/notices/USN-2907-2
- https://ubuntu.com/security/notices/USN-2908-2
- NVD
- Launchpad
- Debian