CVE-2015-5697
published 2015-08-31CVE-2015-5697: The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users…
PriorityP46low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.46%
38.2th percentile
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.1.3-1 (bookworm) | linux 4.1.3-1 (bookworm) |
| linux | linux_kernel | <= 4.1.5 | — |
| linux | linux_kernel | >= 0 < 4.1.3-1 | 4.1.3-1 |
| linux | linux_kernel | >= 0 < 4.1.3-1 | 4.1.3-1 |
| linux | linux_kernel | >= 0 < 4.1.3-1 | 4.1.3-1 |
| linux | linux_kernel | >= 0 < 4.1.3-1 | 4.1.3-1 |
| linux | linux_kernel | >= 0 < 3.13.0-65.105 | 3.13.0-65.105 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv6.1MEDIUM
vendor_ubuntu6.1MEDIUM
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6335-hw2p-8cqf: The get_bitmap_file function in drivers/md/md
ghsa_unreviewed·2022-05-17
CVE-2015-5697 [LOW] CWE-200 GHSA-6335-hw2p-8cqf: The get_bitmap_file function in drivers/md/md
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
OSV
linux-lts-utopic vulnerabilities
osv·2015-10-20·CVSS 6.1
CVE-2015-5156 [MEDIUM] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
It was discovered that virtio networking in the Linux kernel did not handle
fragments correctly, leading to kernel memory corruption. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute code with administrative privileges. (CVE-2015-5156)
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
It was discovered that
OSV
linux-lts-vivid vulnerabilities
osv·2015-09-29·CVSS 2.1
CVE-2015-5697 [LOW] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
OSV
linux vulnerabilities
osv·2015-09-28·CVSS 2.1
CVE-2015-5697 [LOW] linux vulnerabilities
linux vulnerabilities
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
OSV
CVE-2015-5697: The get_bitmap_file function in drivers/md/md
osv·2015-08-31·CVSS 2.1
CVE-2015-5697 [LOW] CVE-2015-5697: The get_bitmap_file function in drivers/md/md
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Kernel
Merge tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md
kernel_security·2015-08-05·CVSS 2.1
CVE-2015-5697 [LOW] Merge tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md
Merge tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md
Pull md fixes from Neil Brown:
"Three more fixes for md in 4.2
Mostly corner-case stuff.
One of these patches is for a CVE: CVE-2015-5697
I'm not convinced it is serious (data leak from CAP_SYS_ADMIN ioctl)
but as people seem to want to back-port it, I've included a minimal
version here. The remainder of that patch from Benjamin is
code-cleanup and will arrive in the 4.3 merge window"
* tag 'md/4.2-rc5-fixes' of git://neil.brown.name/md:
md/raid5: don't let shrink_slab shrink too far.
md: use kzalloc() when bitmap is disabled
md/raid1: extend spinlock to protect raid1_end_read_request against inconsistencies
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2015-10-20·CVSS 6.1
CVE-2015-5156 [MEDIUM] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that virtio networking in the Linux kernel did not handle
fragments correctly, leading to kernel memory corruption. A remote attacker
could use this to cause a denial of service (system crash) or possibly
execute code with administrative privileges. (CVE-2015-5156)
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denia
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2015-09-29·CVSS 2.1
CVE-2015-5697 [LOW] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires yo
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-09-29·CVSS 2.1
CVE-2015-5697 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompil
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2015-09-29·CVSS 2.1
CVE-2015-5697 [LOW] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
(CVE-2015-5697)
Marc-André Lureau discovered that the vhost driver did not properly
release the userspace provided log file descriptor. A privileged attacker
could use this to cause a denial of service (resource exhaustion).
(CVE-2015-6252)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you
Ubuntu
Linux kernel (OMAP4) vulnerability
vendor_ubuntu·2015-09-03
CVE-2015-5697 Linux kernel (OMAP4) vulnerability
Title: Linux kernel (OMAP4) vulnerability
Summary: The system could be made to expose sensitive information.
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uni
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2015-09-03
CVE-2015-5697 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to expose sensitive information.
Benjamin Randazzo discovered an information leak in the md (multiple
device) driver when the bitmap_info.file is disabled. A local privileged
attacker could use this to obtain sensitive information from the kernel.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstalled
Red Hat
kernel: information leak in md driver
vendor_redhat·2015-07-25·CVSS 2.1
CVE-2015-5697 [LOW] CWE-212 kernel: information leak in md driver
kernel: information leak in md driver
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
A cross-boundary flaw was discovered in the Linux kernel software raid driver. The driver accessed a disabled bitmap where only the first byte of the buffer was initialized to zero. This meant that the rest of the request (up to 4095 bytes) was left and copied into user space. An attacker could use this flaw to read private information from user space that would not otherwise have been accessible.
Statement: This issue affects the Linux kernels as shipped with Red Hat Enterprise Linux 5, 6, 7, MRG-2 and realti
Debian
CVE-2015-5697: linux - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6...
vendor_debian·2015·CVSS 2.1
CVE-2015-5697 [LOW] CVE-2015-5697: linux - The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6...
The get_bitmap_file function in drivers/md/md.c in the Linux kernel before 4.1.6 does not initialize a certain bitmap data structure, which allows local users to obtain sensitive information from kernel memory via a GET_BITMAP_FILE ioctl call.
Scope: local
bookworm: resolved (fixed in 4.1.3-1)
bullseye: resolved (fixed in 4.1.3-1)
forky: resolved (fixed in 4.1.3-1)
sid: resolved (fixed in 4.1.3-1)
trixie: resolved (fixed in 4.1.3-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-5697 linux kernel: information leak in md driver [fedora-all]
bugzilla·2015-07-31·CVSS 2.1
CVE-2015-5697 [LOW] CVE-2015-5697 linux kernel: information leak in md driver [fedora-all]
CVE-2015-5697 linux kernel: information leak in md driver [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora.
Bugzilla
CVE-2015-5697 linux kernel: information leak in md driver
bugzilla·2015-07-31·CVSS 2.1
CVE-2015-5697 [LOW] CVE-2015-5697 linux kernel: information leak in md driver
CVE-2015-5697 linux kernel: information leak in md driver
In the md driver (drivers/md/md.c) of the Linux kernel it’s possible to request a bitmap file for a device using get_bitmap_file(), which uses kmalloc().
When bitmap is disabled, only the first byte of the buffer is initialized to zero, and then the whole buffer is copied in user space.
It's possible to read up to 4095 bytes of kernel space memory from user space. This results in local kernel information leak.
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/?id=77ba0569d4c8389c0a2162ab0c7c16a6f3b199e4
CVE assignment:
http://seclists.org/oss-sec/2015/q3/235
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1249013]
---
kernel-4.1.4-200.fc22 has been pushed
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b6878d9e03043695dbf3fa1caa6dfc09db225b16http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163661.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163711.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/164137.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/164193.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.htmlhttp://www.debian.org/security/2015/dsa-3329http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6http://www.openwall.com/lists/oss-security/2015/07/28/2http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/76066http://www.securitytracker.com/id/1033211http://www.ubuntu.com/usn/USN-2731-1http://www.ubuntu.com/usn/USN-2732-1http://www.ubuntu.com/usn/USN-2748-1http://www.ubuntu.com/usn/USN-2749-1http://www.ubuntu.com/usn/USN-2751-1http://www.ubuntu.com/usn/USN-2752-1http://www.ubuntu.com/usn/USN-2777-1https://bugzilla.redhat.com/show_bug.cgi?id=1249011https://github.com/torvalds/linux/commit/b6878d9e03043695dbf3fa1caa6dfc09db225b16http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b6878d9e03043695dbf3fa1caa6dfc09db225b16http://lists.fedoraproject.org/pipermail/package-announce/2015-August/163661.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/163711.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/164137.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-August/164193.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.htmlhttp://www.debian.org/security/2015/dsa-3329http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6http://www.openwall.com/lists/oss-security/2015/07/28/2http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.htmlhttp://www.securityfocus.com/bid/76066http://www.securitytracker.com/id/1033211http://www.ubuntu.com/usn/USN-2731-1http://www.ubuntu.com/usn/USN-2732-1http://www.ubuntu.com/usn/USN-2748-1http://www.ubuntu.com/usn/USN-2749-1http://www.ubuntu.com/usn/USN-2751-1http://www.ubuntu.com/usn/USN-2752-1http://www.ubuntu.com/usn/USN-2777-1https://bugzilla.redhat.com/show_bug.cgi?id=1249011https://github.com/torvalds/linux/commit/b6878d9e03043695dbf3fa1caa6dfc09db225b16
2015-08-31
Published