CVE-2015-7990

Condición de carrera en la función rds_sendmsg en net/rds/sendmsg.c en el kernel de Linux en versiones anteriores a 4.3.3 permite a usuarios locales provocar una denegación de servicio (referencia a puntero NULL y caída del sistema) o posiblemente tener otro impacto no especificado mediante el uso de un socket que no estaba vinculado adecuadamente. NOTA: esta vulnerabilidad existe debido a una solución incompleta para CVE-2015-6937

An update that solves 5 vulnerabilities and has two fixes is now available. This kernel live patch for Linux Kernel 3.12.43-52.6.1 fixes security issues and bugs. A negatively instantiated user key could have been used by a local user to leverage privileges. A NULL pointer dereference flaw was found in the Reliable Datagram Sockets implementation allowing a local user to cause system DoS. A verification was missing that the underlying transport exists when a connection was created. Verify the underlying transport exists before creating a connection, preventing possible DoS. Possible crash when trying to garbage collect an uninstantiated keyring. The prepend_path function in fs/dcache.c in the Linux kernel did not properly handle rename actions inside a bind mount, which allowed local users to bypass an intended container protection mechanism by renaming a directory, related to a "double-chroot attack. Non-security bugfix were also done.