PT-2015-7820 · Linux+3 · Linux Kernel+3

Jann Horn · Publicado 2015-12-12 · Atualizado 2024-08-06 · CVE-2015-8709

Positive Technologies (AI Summary)

CVSS v3.1

7.0

Alta

Vetor base

AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 4.4.1

Description The Linux kernel mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. The vendor states that there is no kernel bug.

Recommendations For Linux kernel versions through 4.4.1, consider updating to a version later than 4.4.1 to resolve the issue. As a temporary workaround, consider restricting the use of the ptrace system call to minimize the risk of exploitation. Additionally, be cautious when using user namespaces and ensure that uid and gid mappings are handled safely.

Exploit

Correção

Enumeração de Fraquezas

CWE-264

Identificadores relacionados

ALT-PU-2016-1137

ALT-PU-2016-1485

CVE-2015-8709

DSA-3434-1

OPENSUSE-SU-2016_1008-1

OPENSUSE-SU-2016_2144-1

OPENSUSE-SU-2017_0456-1

SUSE-SU-2016:0785-1

SUSE-SU-2016:1019-1

SUSE-SU-2016:1031-1

SUSE-SU-2016:1032-1

SUSE-SU-2016:1033-1

SUSE-SU-2016:1034-1

SUSE-SU-2016:1035-1

SUSE-SU-2016:1037-1

SUSE-SU-2016:1038-1

SUSE-SU-2016:1039-1

SUSE-SU-2016:1040-1

SUSE-SU-2016:1041-1

SUSE-SU-2016:1045-1

SUSE-SU-2016:1046-1

SUSE-SU-2016:1764-1

SUSE-SU-2017:0575-1

SUSE-SU-2017_0575-1

USN-2847-1

USN-2848-1

USN-2849-1

USN-2850-1

USN-2851-1

USN-2852-1

USN-2853-1

USN-2854-1

Produtos afetados

Alt Linux

Linux Kernel

Suse

Ubuntu

Referências · 701

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/overlayfs_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/netfilter_priv_esc_ipv4.rb · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-9793 · Exploit
• 🔥 https://github.com/Kagami/docker_cve-2015-2925 · Exploit
• 🔥 https://github.com/whu-enjoy/CVE-2015-8660 · Exploit
• https://github.com/torvalds/linux/commit/8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4 · Nota
• https://github.com/nccgroup/TriforceLinuxSyscallFuzzer/tree/master/crash_reports/report_compatIpt · Nota
• https://github.com/pqsec/uboatdemo · Nota
• https://bugzilla.suse.com/1017170 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2015-8709 · Nota de Segurança
• https://bugzilla.suse.com/968013 · Nota
• https://bugzilla.suse.com/975371 · Nota
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html · Aviso do Fabricante
• https://bugzilla.suse.com/963825 · Nota