CVE-2015-8539

Published: 7 February 2016

The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.

From the Ubuntu Security Team

Dmitry Vyukov discovered that the key management subsystem in the Linux kernel did not properly restrict adding a key that already exists but is negatively instantiated. A local attacker could use this to cause a denial of service (system crash) or possibly execute arbitrary code.

Notes

Debian's triage suggested this was introduced by
146aa8b1453bd8f1ff2304ffb71b4ee0eb9acdcc

verified this is an issue with precise's kernel, the second
reproducer in the git commit results in a NULL pointer exception

As sbeattie mentioned above, this is present prior to 4.4.
I'm setting the break commit to the start of git history which is
after user keys were added

Status

Severity score breakdown

References

• https://bugzilla.redhat.com/show_bug.cgi?id=1284450
• http://www.openwall.com/lists/oss-security/2015/12/09/1
• https://ubuntu.com/security/notices/USN-3798-1
• https://ubuntu.com/security/notices/USN-3798-2
• https://www.cve.org/CVERecord?id=CVE-2015-8539
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1525569