CVE-2015-8569
published 2015-12-28CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows…
PriorityP48low2.3CVSS 3.0
AVLACLPRHUINSUCLINAN
EPSS
0.48%
39.5th percentile
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 4.3.3-3 (bookworm) | linux 4.3.3-3 (bookworm) |
| linux | linux_kernel | <= 4.3.2 | — |
| linux | linux_kernel | >= 0 < 4.3.3-3 | 4.3.3-3 |
| linux | linux_kernel | >= 0 < 4.3.3-3 | 4.3.3-3 |
| linux | linux_kernel | >= 0 < 4.3.3-3 | 4.3.3-3 |
| linux | linux_kernel | >= 0 < 4.3.3-3 | 4.3.3-3 |
| linux | linux_kernel | >= 0 < 3.13.0-79.123 | 3.13.0-79.123 |
CVSS provenance
nvdv3.02.3LOWCVSS:3.0/AV:L/AC:L/PR:H/UI:N/S:U/C:L/I:N/A:N
nvdv2.01.9LOWAV:L/AC:M/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_ubuntu5.5MEDIUM
vendor_debian2.3LOW
vendor_redhat2.3LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Vivid HWE) regression
vendor_ubuntu·2016-02-27·CVSS 5.5
[MEDIUM] Linux kernel (Vivid HWE) regression
Title: Linux kernel (Vivid HWE) regression
Summary: USN-2910-1 introduced a regression in the Ubuntu 15.04 Linux kernel
backported to Ubuntu 14.04 LTS.
USN-2910-1 fixed vulnerabilities in the Ubuntu 15.04 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a
regression that broke graphics displays for Ubuntu 14.04 LTS guests
running the Ubuntu 15.04 backport kernel within VMWare virtual
machines. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrect
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 5.5
CVE-2015-7550 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as
POSIX ACLs. A local unprivileged attacker could use this to gain
privileges. (CVE-2016-1575)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
郭永刚 discovered that the Linux kernel networking implementation did
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 5.5
CVE-2015-7550 [MEDIUM] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
郭永刚 discovered that the Linux kernel networking implem
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-02-22·CVSS 5.5
CVE-2015-7550 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as
POSIX ACLs. A local unprivileged attacker could use this to gain
privileges. (CVE-2016-1575)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
郭永刚 discovered that the Linux kernel networking imple
Ubuntu
Linux kernel (Wily HWE) vulnerabilities
vendor_ubuntu·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel (Wily HWE) vulnerabilities
Title: Linux kernel (Wily HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of servic
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of se
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system cra
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-02-01·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
郭永刚 discovered that the ppp implementation in the Linux kernel did
not ensure that certain slot numbers are valid. A local attacker with the
privilege to call ioctl() on /dev/ppp coul
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2016-02-01·CVSS 5.3
CVE-2013-7446 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
郭永刚 discovered that the ppp implementation in the Linux kernel did
not ensure that certain slot numbers are valid. A local attacker with the
privilege to call ioctl() on /dev/
Red Hat
kernel: Information leak from getsockname
vendor_redhat·2015-12-14·CVSS 2.3
CVE-2015-8569 [LOW] CWE-125 kernel: Information leak from getsockname
kernel: Information leak from getsockname
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
An out-of-bounds flaw was found in the kernel, where the length of the sockaddr parameter was not checked in the pptp_bind() and pptp_connect() functions. As a result, more kernel memory was copied out than required, leaking information from the kernel stack (including kernel addresses). A local system user could exploit this flaw to bypass kernel ASLR or leak other information.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Ha
Debian
CVE-2015-8569: linux - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in th...
vendor_debian·2015·CVSS 2.3
CVE-2015-8569 [LOW] CVE-2015-8569: linux - The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in th...
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Scope: local
bookworm: resolved (fixed in 4.3.3-3)
bullseye: resolved (fixed in 4.3.3-3)
forky: resolved (fixed in 4.3.3-3)
sid: resolved (fixed in 4.3.3-3)
trixie: resolved (fixed in 4.3.3-3)
GHSA
GHSA-9wfh-75q9-qc53: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp
ghsa_unreviewed·2022-05-17
CVE-2015-8569 [LOW] CWE-200 GHSA-9wfh-75q9-qc53: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
OSV
linux-lts-vivid regression
osv·2016-02-27·CVSS 5.5
[MEDIUM] linux-lts-vivid regression
linux-lts-vivid regression
USN-2910-1 fixed vulnerabilities in the Ubuntu 15.04 Linux kernel
backported to Ubuntu 14.04 LTS. An incorrect locking fix caused a
regression that broke graphics displays for Ubuntu 14.04 LTS guests
running the Ubuntu 15.04 backport kernel within VMWare virtual
machines. This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain
OSV
linux-lts-vivid vulnerabilities
osv·2016-02-22·CVSS 5.5
CVE-2016-1576 [MEDIUM] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as POSIX ACLs. A
local unprivileged attacker could use this to gain privileges.
(CVE-2016-1575)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
郭永刚 discovered that the Linux kernel networking implementation did
not validate protocol identifiers for certain protocol families
OSV
linux vulnerabilities
osv·2016-02-22·CVSS 5.5
CVE-2016-1576 [MEDIUM] linux vulnerabilities
linux vulnerabilities
halfdog discovered that OverlayFS, when mounting on top of a FUSE mount,
incorrectly propagated file attributes, including setuid. A local
unprivileged attacker could use this to gain privileges. (CVE-2016-1576)
halfdog discovered that OverlayFS in the Linux kernel incorrectly
propagated security sensitive extended attributes, such as
POSIX ACLs. A local unprivileged attacker could use this to gain
privileges. (CVE-2016-1575)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
郭永刚 discovered that the Linux kernel networking implementation did
not validate protocol identifiers for certain protocol families, A local
OSV
linux-lts-wily vulnerabilities
osv·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] linux-lts-wily vulnerabilities
linux-lts-wily vulnerabilities
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
Sasha Levin discovered that the Reliable Da
OSV
linux-lts-utopic vulnerabilities
osv·2016-02-02·CVSS 5.3
CVE-2013-7446 [MEDIUM] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
It was discovered that a use-after-free vulnerability existed in the
AF_UNIX implementation in the Linux kernel. A local attacker could use
crafted epoll_ctl calls to cause a denial of service (system crash) or
expose sensitive information. (CVE-2013-7446)
It was discovered that the KVM implementation in the Linux kernel did not
properly restore the values of the Programmable Interrupt Timer (PIT). A
user-assisted attacker in a KVM guest could cause a denial of service in
the host (system crash). (CVE-2015-7513)
It was discovered that the Linux kernel keyring subsystem contained a race
between read and revoke operations. A local attacker could use this to
cause a denial of service (system crash). (CVE-2015-7550)
Sasha Levin discovered that the Reliable
OSV
CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp
osv·2015-12-28·CVSS 2.3
CVE-2015-8569 [LOW] CVE-2015-8569: The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp
The (1) pptp_bind and (2) pptp_connect functions in drivers/net/ppp/pptp.c in the Linux kernel through 4.3.3 do not verify an address length, which allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2015-8575 kernel: information leak in sco_sock_bind()
bugzilla·2015-12-18·CVSS 2.3
CVE-2015-8575 [LOW] CVE-2015-8575 kernel: information leak in sco_sock_bind()
CVE-2015-8575 kernel: information leak in sco_sock_bind()
An issue similar to CVE-2015-8569 was fixed in the Linux kernel. The sco_sock_bind() function (bluetooth/sco) did not check the length of the passed sockaddr, copying out more kernel memory than required, leaking information from the kernel stack, including kernel addresses. This can be used for KASLR bypass or other information leaks.
Upstream commit:
http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
CVE request and assignment:
http://seclists.org/oss-sec/2015/q4/516
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1292841]
---
kernel-4.3.3-300.fc23 has been pushed to the Fedora 23 stable repository. If problems still persist, ple
Bugzilla
CVE-2015-8569 kernel: Information leak from getsockname
bugzilla·2015-12-16·CVSS 2.3
CVE-2015-8569 [LOW] CVE-2015-8569 kernel: Information leak from getsockname
CVE-2015-8569 kernel: Information leak from getsockname
It was found that there was missing the check of the length of the passed sockaddr in pptp_bind() and pptp_connect() functions, copying out more kernel memory than required, leaking information from the kernel stack, including kernel addresses. This can be used for kernel ASLR bypassing or other information leaks.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=09ccfd238e5a0e670d8178cf50180ea81ae09ae1
Reproducer:
https://lkml.org/lkml/2015/12/14/252
CVE assignment:
http://seclists.org/oss-sec/2015/q4/510
Discussion:
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1292047]
---
kernel-4.3.3-300.fc23 has been pushed to the Fedora 23 stable repository. If problems sti
Bugzilla
CVE-2015-8569 kernel: Information leak from getsockname [fedora-all]
bugzilla·2015-12-16·CVSS 2.3
CVE-2015-8569 [LOW] CVE-2015-8569 kernel: Information leak from getsockname [fedora-all]
CVE-2015-8569 kernel: Information leak from getsockname [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. W
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=09ccfd238e5a0e670d8178cf50180ea81ae09ae1http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://twitter.com/grsecurity/statuses/676744240802750464http://www.debian.org/security/2016/dsa-3434http://www.openwall.com/lists/oss-security/2015/12/15/11http://www.securityfocus.com/bid/79428http://www.securitytracker.com/id/1034549http://www.ubuntu.com/usn/USN-2886-1http://www.ubuntu.com/usn/USN-2888-1http://www.ubuntu.com/usn/USN-2890-1http://www.ubuntu.com/usn/USN-2890-2http://www.ubuntu.com/usn/USN-2890-3https://bugzilla.redhat.com/show_bug.cgi?id=1292045https://github.com/torvalds/linux/commit/09ccfd238e5a0e670d8178cf50180ea81ae09ae1https://lkml.org/lkml/2015/12/14/252http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=09ccfd238e5a0e670d8178cf50180ea81ae09ae1http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlhttp://twitter.com/grsecurity/statuses/676744240802750464http://www.debian.org/security/2016/dsa-3434http://www.openwall.com/lists/oss-security/2015/12/15/11http://www.securityfocus.com/bid/79428http://www.securitytracker.com/id/1034549http://www.ubuntu.com/usn/USN-2886-1http://www.ubuntu.com/usn/USN-2888-1http://www.ubuntu.com/usn/USN-2890-1http://www.ubuntu.com/usn/USN-2890-2http://www.ubuntu.com/usn/USN-2890-3https://bugzilla.redhat.com/show_bug.cgi?id=1292045https://github.com/torvalds/linux/commit/09ccfd238e5a0e670d8178cf50180ea81ae09ae1https://lkml.org/lkml/2015/12/14/252
2015-12-28
Published