CVE-2015-7872

CVSS V2 Low 2.1 CVSS V3 None
Description
The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands.
Overview
  • CVE ID
  • CVE-2015-7872
  • Assigner
  • secalert@redhat.com
  • Vulnerability Status
  • Modified
  • Published Version
  • 2015-11-16T11:59:10
  • Last Modified Date
  • 2023-02-13T00:55:06
CPE Configuration (Product)
CPE Vulnerable Operator Version Start Version End
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* 1 OR 4.2.6
CVSS Version 2
  • Version
  • 2.0
  • Vector String
  • AV:L/AC:L/Au:N/C:N/I:N/A:P
  • Access Vector
  • LOCAL
  • Access Compatibility
  • LOW
  • Authentication
  • NONE
  • Confidentiality Impact
  • NONE
  • Integrity Impact
  • NONE
  • Availability Impact
  • PARTIAL
  • Base Score
  • 2.1
  • Severity
  • LOW
  • Exploitability Score
  • 3.9
  • Impact Score
  • 2.9
References
Reference URL Reference Tags
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ce1fad2740c648a4340f6f6c391a8a83769d2e8c
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61 Vendor Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00035.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00026.html
http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00031.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00013.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html
http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html
http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
http://marc.info/?l=bugtraq&m=145975164525836&w=2
http://rhn.redhat.com/errata/RHSA-2015-2636.html
http://rhn.redhat.com/errata/RHSA-2016-0185.html
http://rhn.redhat.com/errata/RHSA-2016-0212.html
http://rhn.redhat.com/errata/RHSA-2016-0224.html
http://www.debian.org/security/2015/dsa-3396
http://www.openwall.com/lists/oss-security/2015/10/20/6
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
http://www.securityfocus.com/bid/77544
http://www.securitytracker.com/id/1034472
http://www.ubuntu.com/usn/USN-2823-1
http://www.ubuntu.com/usn/USN-2824-1
http://www.ubuntu.com/usn/USN-2826-1
http://www.ubuntu.com/usn/USN-2829-1
http://www.ubuntu.com/usn/USN-2829-2
http://www.ubuntu.com/usn/USN-2840-1
http://www.ubuntu.com/usn/USN-2840-2
http://www.ubuntu.com/usn/USN-2843-1
http://www.ubuntu.com/usn/USN-2843-2
http://www.ubuntu.com/usn/USN-2843-3
https://access.redhat.com/errata/RHSA-2015:2636
https://access.redhat.com/errata/RHSA-2016:0185
https://access.redhat.com/errata/RHSA-2016:0212
https://access.redhat.com/errata/RHSA-2016:0224
https://access.redhat.com/security/cve/CVE-2015-7872
https://bugzilla.redhat.com/show_bug.cgi?id=1272172
https://bugzilla.redhat.com/show_bug.cgi?id=1272371
https://github.com/torvalds/linux/commit/ce1fad2740c648a4340f6f6c391a8a83769d2e8c Vendor Advisory
https://github.com/torvalds/linux/commit/f05819df10d7b09f6d1eb6f8534a8f68e5a4fe61
https://h20566.www2.hpe.com/portal/site/hpsc/public/kb/docDisplay?docId=emr_na-c05068676
https://source.android.com/security/bulletin/2016-12-01.html
History
Created Old Value New Value Data Type Notes
2022-05-10 09:50:08 Added to TrackCVE
2022-12-02 07:14:35 2015-11-16T11:59Z 2015-11-16T11:59:10 CVE Published Date updated
2022-12-02 07:14:35 2017-01-20T02:59:03 CVE Modified Date updated
2022-12-02 07:14:35 Modified Vulnerability Status updated
2023-02-02 17:05:12 2023-02-02T16:17:20 CVE Modified Date updated
2023-02-02 17:05:13 The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands. It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. Description updated
2023-02-02 17:05:21 References updated
2023-02-13 01:06:18 2023-02-13T00:55:06 CVE Modified Date updated
2023-02-13 01:06:18 It was found that the Linux kernel's keys subsystem did not correctly garbage collect uninstantiated keyrings. A local attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system. The key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 4.2.6 allows local users to cause a denial of service (OOPS) via crafted keyctl commands. Description updated