Revision history [back]
 | 1 | initial version | posted 2017-07-03 11:45:26 +0200  |
Fix race between read and revoke in kernel-security-keys CVE-2015-7550
The keyctl_read_key function in security/keys/keyctl.c in the Linux kernel before 4.3.4 does not properly use a semaphore, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted application that leverages a race condition between keyctl_revoke and keyctl_read calls. CVSS v3 Base Score: 5.5 Medium
Patch for Kernel 3.4 available
File affected: /kernel-adaptation-sbj-3.4.108.20161101.1/security/keys/keyctl.c lines 703-717