CVE-2015-9016: Use After Free

Published Feb 5, 2018

Updated

In blkmqtagtorq in blk-mq.c in the upstream kernel, there is a possible use after free due to a race condition when a request has been previously freed by blkmqcompleterequest. This could lead to local escalation of privilege. Product: Android. Versions: Android kernel. Android ID: A-63083046.

Affected Software

3 affected componentsFixes available

Google Android

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1

Event History

Feb 5, 2018

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityWeaknessAffected Software

Apr 5, 2018

CVE Published

via MITRE·06:00 PM

Data Sourced

via MITRE·06:00 PM

DescriptionWeakness

Parent advisories

This vulnerability appears in the following advisories.

DSA-4187

Frequently Asked Questions

Who is realistically exposed to this issue?

Systems running an affected Android kernel or Debian/Linux kernel are exposed. Exploitation is local, so an attacker needs the ability to execute code on the target system.

What level of access does an attacker need?

The CVSS vector specifies low privileges and no user interaction. A local attacker with limited existing access could potentially escalate privileges.

What is the underlying trigger for exploitation?

The flaw is a race condition in blk_mq_tag_to_rq when a request was previously freed by blk_mq_complete_request. Successful exploitation depends on winning that race, reflected by the high attack complexity rating.

How can I determine whether a system may be affected?

Identify whether the system uses an Android kernel or Debian/Linux kernel and check whether its kernel includes the upstream fix associated with commit 0048b4837affd153897ed1222283492070027aa9. Android deployments can also track Android ID A-63083046.

CVE-2015-9016: Use After Free

Affected Software

Remediation

Event History

Parent advisories

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access does an attacker need?

What is the underlying trigger for exploitation?

How can I determine whether a system may be affected?

Company

Resources

Contact

Frequently Asked Questions

Who is realistically exposed to this issue?

What level of access does an attacker need?

What is the underlying trigger for exploitation?

How can I determine whether a system may be affected?