CVE-2015-8543: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way the Linux kernel's network subsystem handled socket creation with an invalid protocol identifier. A local user could use this flaw to crash the system.
Other sources
It was found that in net/ipv4/afinet.c, PC will contain 0x0 if sk->skprot->getport is NULL, leading to kernel null pointer dereference.
Vulnerable code:
static int inetautobind(struct sock sk) { struct inetsock inet; / We may need to bind the socket. / locksock(sk); inet = inetsk(sk); if (!inet->inetnum) { if (sk->skprot->getport(sk, 0)) { releasesock(sk); return -EAGAIN; } inet->inetsport = htons(inet->inetnum); } releasesock(sk); return 0; }
CVE request (contains reproducer):
http://seclists.org/oss-sec/2015/q4/458
— Red Hat
The networking implementation in the Linux kernel through 4.3.3, as used in Android and other products, does not validate protocol identifiers for certain protocol families, which allows local users to cause a denial of service (NULL function pointer dereference and system crash) or possibly gain privileges by leveraging CLONENEWUSER support to execute a crafted SOCKRAW application.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is CVE-2015-8543?
CVE-2015-8543 is a vulnerability in the Linux kernel's network subsystem that allows local users to cause a denial of service or possibly gain privileges.
Which products are affected by CVE-2015-8543?
The Linux kernel through version 4.3.3, as used in Android and other products, is affected.
How severe is CVE-2015-8543?
CVE-2015-8543 has a severity rating of medium.
How can CVE-2015-8543 be exploited?
CVE-2015-8543 can be exploited by local users to cause a denial of service or possibly gain privileges.
Is there a fix available for CVE-2015-8543?
Yes, the recommended remedy for CVE-2015-8543 is to update to Linux kernel version 4.4~.