CVE-2015-8709

Published: 12 December 2015

** DISPUTED ** kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here."

From the Ubuntu Security Team

Jann Horn discovered a ptrace issue with user namespaces in the Linux kernel. The namespace owner could potentially exploit this flaw by ptracing a root owned process entering the user namespace to elevate its privileges and potentially gain access outside of the namespace. (http://bugs.launchpad.net/bugs/1527374, CVE-2015-8709)

Notes

published fix has been reverted and replaced by upstream
commit. Published kernels are not vulnerable to this, the status is
tracking the state of the replaced commit coming through the trees.

Status

Severity score breakdown

References

• https://lkml.org/lkml/2015/12/12/259
• https://ubuntu.com/security/notices/USN-2847-1
• https://ubuntu.com/security/notices/USN-2848-1
• https://ubuntu.com/security/notices/USN-2849-1
• https://ubuntu.com/security/notices/USN-2850-1
• https://ubuntu.com/security/notices/USN-2851-1
• https://ubuntu.com/security/notices/USN-2852-1
• https://ubuntu.com/security/notices/USN-2853-1
• https://ubuntu.com/security/notices/USN-2854-1
• http://www.openwall.com/lists/oss-security/2015/12/31/5
• https://www.cve.org/CVERecord?id=CVE-2015-8709
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1527374