CVE-2015-7884: Infoleak
An information leak flaw was found in Linux kernel for systems using Vivid! display drivers in framebuffer mode. 16 bytes of memory is not zeroed and may leak from userspace to a user at the console.
Original report:
http://seclists.org/oss-sec/2015/q4/115
Upstream patch:
http://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/?id=eda98796aff0d9bf41094b06811f5def3b4c333c
Other sources
The vividfbioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through 4.3.3 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory via a crafted application.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2015-7884.
What is the severity of CVE-2015-7884?
The severity of CVE-2015-7884 is low, with a severity value of 2.3.
Which Linux kernel versions are affected by CVE-2015-7884?
The Linux kernel versions up to 4.3.3 are affected by CVE-2015-7884.
How can a local user exploit CVE-2015-7884?
A local user can exploit CVE-2015-7884 to obtain sensitive information from kernel memory via a crafted application.
Where can I find more information about CVE-2015-7884?
You can find more information about CVE-2015-7884 at the following references: [CVE-2015-7884](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-7884), [Git commit](https://git.kernel.org/cgit/linux/kernel/git/next/linux-next.git/commit/?id=eda98796aff0d9bf41094b06811f5def3b4c333c), [Ubuntu Security Notice](https://ubuntu.com/security/notices/USN-2843-1).