Fix race between read and revoke in kernel-security-keys CVE-2015-7550
asked 2017-07-03 11:45:26 +0200
This post is a wiki. Anyone with karma >75 is welcome to improve it.
The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls. CVSS v3 Base Score: 5.5 Medium
Patch for Kernel 3.4 available
File affected: /kernel-adaptation-sbj-3.4.108.20161101.1/security/keys/keyctl.c lines 703-717