CVE-2015-2830: Low severity debian linux vulnerability
A flaw was found in the way the Linux kernel's 32-bit emulation implementation handled forking or closing of a task with an 'int80' entry. A local user could potentially use this flaw to escalate their privileges on the system.
Other sources
arch/x86/kernel/entry64.S in the Linux kernel before 3.19.2 does not prevent the TSCOMPAT flag from reaching a user-mode task, which might allow local users to bypass the seccomp or audit protection mechanism via a crafted application that uses the (1) fork or (2) close system call, as demonstrated by an attack against seccomp before 3.16.
Linux kernel built with the 32-bit emulation support(CONFIGIA32EMULATION), is vulnerable to potential privilege escalation flaw. This could occur while calling fork(2) & close(2) system calls with an 'int80' entry, which results in an inappropriate task state in the child process.
An unprivileged user could potentially use this flaw to overcome certain kernel enforced and intended limitations such as seccomp policy and thus increase their privileges on the system.
Upstream fix: ------------- -> https://git.kernel.org/linus/956421fbb74c3a6261903f3836c0740187cf038b
Reference: ---------- -> http://seclists.org/oss-sec/2015/q2/8
— Red Hat
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2015-2830?
CVE-2015-2830 has a medium severity rating due to the potential for local privilege escalation.
How do I fix CVE-2015-2830?
To fix CVE-2015-2830, upgrade to the patched versions of the kernel as provided by your Linux distribution.
Which Linux kernel versions are affected by CVE-2015-2830?
CVE-2015-2830 affects Linux kernel versions prior to 3.19.2.
What types of operating systems are impacted by CVE-2015-2830?
CVE-2015-2830 impacts various Linux distributions including Red Hat, Debian, and Ubuntu.
Can CVE-2015-2830 be exploited remotely?
CVE-2015-2830 cannot be exploited remotely, as it requires local user access to the system.