CVE-2015-8539: High severity Canonical Ubuntu Linux vulnerability
A flaw was found in the Linux kernels key management system where it was possible for an attacker to escalate privileges or crash the machine.
If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively instantiated by updating it with valid data. However, the ->update key type method must be aware that the error code may be there.
Key management subsystems can abused to escalate privileges through memory corruption.
Upstream: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096fe9eaea40a17e125569f9e657e34cdb6d73bd
Other sources
A flaw was found in the Linux kernel's key management system where it was possible for an attacker to escalate privileges or crash the machine. If a user key gets negatively instantiated, an error code is cached in the payload area. A negatively instantiated key may be then be positively instantiated by updating it with valid data. However, the ->update key type method must be aware that the error code may be there.
The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/userdefined.c.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.17.1.rt56.636.el7 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-693.17.1.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 1:3.10.0-693.17.1.rt56.604.el6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.262-1Fixed in 6.1.176-1Fixed in 6.1.180-1Fixed in 6.12.94-1Fixed in 6.12.101-1Fixed in 7.1.7-1Fixed in 7.1.8-1 - Compensating control
Apply the upstream fix commit for the Linux kernel KEYS key management privilege-escalation/DoS issue (commit id: 096fe9eaea40a17e125569f9e657e34cdb6d73bd) to the affected kernels.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2015-8539?
CVE-2015-8539 is a vulnerability in the Linux kernel that allows local users to gain privileges or crash the machine.
How severe is CVE-2015-8539?
CVE-2015-8539 has a severity score of 7, which is considered high.
Which software versions are affected by CVE-2015-8539?
The Linux kernel versions before 4.4 are affected by CVE-2015-8539.
What is the remedy for CVE-2015-8539?
To fix CVE-2015-8539, update your Linux kernel to version 4.4~ or later.
Where can I find more information about CVE-2015-8539?
You can find more information about CVE-2015-8539 at the following references: [Link 1](https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=096fe9eaea40a17e125569f9e657e34cdb6d73bd), [Link 2](https://access.redhat.com/security/cve/CVE-2015-8539), [Link 3](http://seclists.org/oss-sec/2015/q4/465).