Fix race between read and revoke in kernel-security-keys CVE-2015-7550

Tracked by Jolla (In progress)

asked 2017-07-03 11:45:26 +0300

this post is marked as community wiki

This post is a wiki. Anyone with karma >75 is welcome to improve it.

updated 2017-07-03 11:45:26 +0300

lpr gravatar image

The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls. CVSS v3 Base Score: 5.5 Medium

Patch for Kernel 3.4 available

File affected: /kernel-adaptation-sbj- lines 703-717

edit retag flag offensive close delete