PT-2016-2593 · Linux+2 · Linux Kernel+2

Publicado

2016-08-06

·

Atualizado

2017-07-25

·

CVE-2015-8944

CVSS v3.1

5.5

Média

VetorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7
Description The issue is related to the ioresources init function in the Linux kernel, which uses weak permissions for the /proc/iomem file. This allows local users to obtain sensitive information by reading this file. The problem is noted in Android versions before 2016-08-05 on Nexus 6 and 7 (2013) devices. It is worth noting that the permissions may be intentional in most non-Android contexts.
Recommendations For Linux kernel versions prior to 4.7, consider restricting access to the /proc/iomem file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

ALT-PU-2016-1862
ALT-PU-2017-1330
BDU:2016-01985
CVE-2015-8944
USN-3360-1
USN-3360-2
USN-3364-1
USN-3364-2
USN-3364-3

Produtos afetados

Alt Linux
Linux Kernel
Ubuntu