CVE-2015-8575: Infoleak
First published: Fri Dec 18 2015(Updated: )
An issue similar to <a href="https://access.redhat.com/security/cve/CVE-2015-8569">CVE-2015-8569</a> was fixed in the Linux kernel. The sco_sock_bind() function (bluetooth/sco) did not check the length of the passed sockaddr, copying out more kernel memory than required, leaking information from the kernel stack, including kernel addresses. This can be used for KASLR bypass or other information leaks. Upstream commit: <a href="http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4">http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4</a> CVE request and assignment: <a href="http://seclists.org/oss-sec/2015/q4/516">http://seclists.org/oss-sec/2015/q4/516</a>
Credit: security@opentext.com meissner@suse.de
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | <=4.3.3 | |
| debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://www.debian.org/security/2016/dsa-3434
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.4
- http://www.openwall.com/lists/oss-security/2015/12/16/3
- http://www.securityfocus.com/bid/79724
- http://www.ubuntu.com/usn/USN-2886-1
- http://www.ubuntu.com/usn/USN-2888-1
- http://www.ubuntu.com/usn/USN-2890-1
- http://www.ubuntu.com/usn/USN-2890-2
- http://www.ubuntu.com/usn/USN-2890-3
- https://bugzilla.redhat.com/show_bug.cgi?id=1292840
- https://github.com/torvalds/linux/commit/5233252fce714053f0151680933571a2da9cbfb4
- https://launchpad.net/bugs/cve/CVE-2015-8575
- https://access.redhat.com/security/cve/CVE-2015-8569
- http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
- http://seclists.org/oss-sec/2015/q4/516
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=1292841
- https://access.redhat.com/support/policy/updates/errata/
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=5233252fce714053f0151680933571a2da9cbfb4
- https://security-tracker.debian.org/tracker/CVE-2015-8575
- https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-8575
- https://nvd.nist.gov/vuln/detail/CVE-2015-8575
- https://ubuntu.com/security/CVE-2015-8575
Frequently Asked Questions
What is the vulnerability ID?
The vulnerability ID is CVE-2015-8575.
What is the severity of CVE-2015-8575?
The severity of CVE-2015-8575 is low.
How does CVE-2015-8575 impact Linux kernel?
CVE-2015-8575 allows local users to obtain sensitive information from kernel memory and bypass the KASLR protection mechanism via a crafted application.
Which versions of Linux kernel are affected by CVE-2015-8575?
Linux kernel versions before 4.3.4 are affected by CVE-2015-8575.
How can I fix CVE-2015-8575?
Update your Linux kernel to version 4.3.4 or higher to fix CVE-2015-8575.
- collector/nvd-index
- agent/type
- agent/remedy
- collector/launchpad-cve
- source/Launchpad
- collector/redhat-bugzilla
- source/Red Hat
- alias/CVE-2015-8575
- agent/author
- agent/weakness
- agent/severity
- collector/mitre-cve
- source/MITRE
- collector/usn-cve
- source/Ubuntu
- agent/references
- agent/tags
- agent/description
- agent/first-publish-date
- agent/event
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup
- agent/last-modified-date
- collector/security-tracker-debian
- source/Debian
- agent/softwarecombine
- agent/trending
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/4.3.3
- package-manager/debian