CVE-2015-5707: Integer Overflow
Integer overflow in the sgstartreq function in drivers/scsi/sg.c in the Linux kernel 2.6.x through 4.x before 4.1 allows local users to cause a denial of service or possibly have unspecified other impact via a large iovcount value in a write request.
Other sources
This bug, which was probably introduced in Linux 2.6.28, was assigned CVE. In drivers/scsi/sg.c in function startreq(), there was code segment vulnerable to number wraparound in the calculation of total number of pages in biomapuseriov(). This can result to allocating small array of pointers to pages that would be overflowed. It was fixed in Linux 4.1-rc1.
CVE assignment: http://seclists.org/oss-sec/2015/q3/278
Upstream patches: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=fdc81f45e9f57858da6351836507fbcf1b7583ee http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=451a2886b6bf90e2fb378f7c46c655450fb96e81
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-5707?
The severity of CVE-2015-5707 is medium.
How does CVE-2015-5707 affect Linux kernel?
CVE-2015-5707 allows local users to cause a denial of service or possibly have unspecified other impact via a large iov_count value in a write request.
Which versions of Linux kernel are affected by CVE-2015-5707?
Linux kernel versions 2.6.x through 4.x before 4.1 are affected by CVE-2015-5707.
How do I fix CVE-2015-5707?
To fix CVE-2015-5707, update your Linux kernel to version 4.1~ or later.
Where can I find more information about CVE-2015-5707?
You can find more information about CVE-2015-5707 at the following references: [1] [2] [3].