CVE-2015-1420: Race Condition
A specially crafted user space application may exploit a bug in handletopath to copy additional data to a target application. This defect is caused by the kernel incorrectly assuming that the arguments provided do not change.
This is problematic since the kernel does size verifications only after the first read, so if the number of extra bytes changes in userspace between the first and second calls, we'll have an incoherent view of filehandle.
The fix is to read the size once, and copy that over to the final structure referencing it from that point rather than the value from the application which may change.
The patch is not yet present in official kernel tree: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/log/fs/fhandle.c
Proposed Patch: http://marc.info/?l=linux-kernel&m=142247707318982&w=2
Other sources
Race condition in the handletopath function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handlebytes value of a file handle during the execution of this function.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability severity of CVE-2015-1420?
CVE-2015-1420 has been classified with a high severity due to potential data leakage and application manipulation.
How do I fix CVE-2015-1420?
To fix CVE-2015-1420, upgrade to the patched versions of the Linux kernel as specified in the advisory.
Which systems are affected by CVE-2015-1420?
CVE-2015-1420 affects several versions of the Linux kernel, specifically versions up to 3.18.9 and specific Debian kernel packages.
Can CVE-2015-1420 be exploited remotely?
CVE-2015-1420 is primarily an issue with local user applications, making remote exploitation unlikely but not impossible if local access is compromised.
What are the potential impacts of CVE-2015-1420?
The potential impacts of CVE-2015-1420 include unintended data copying, leading to information disclosure and application errors.