CVE-2015-7872

La función key_gc_unused_keys en security/keys/gc.c en el kernel Linux hasta la versión 4.2.6 permite a usuarios locales causar una denegación de servicio (OOPS) a través de comandos keyctl manipulados.

It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.

An update that solves 5 vulnerabilities and has two fixes is now available. This kernel live patch for Linux Kernel 3.12.43-52.6.1 fixes security issues and bugs. A negatively instantiated user key could have been used by a local user to leverage privileges. A NULL pointer dereference flaw was found in the Reliable Datagram Sockets implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. Verify the underlying transport exists before creating a connection, preventing possible DoS. Possible crash when trying to garbage collect an uninstantiated keyring. The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack. Non-security bugfix were also done.