Information exposure in Linux kernel - CVE-2015-8569
Published: December 28, 2015 / Updated: November 4, 2017
Vulnerability identifier: #VU92477
CSH Severity: Low
CVSS v4: 4.6 [CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-8569
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local privileged user to gain access to sensitive information.
The vulnerability exists due to information exposure error within the pptp_bind() and pptp_connect() functions in drivers/net/ppp/pptp.c. A local privileged user can gain access to sensitive information.
Affected software
Linux kernel
Fedora
kernel
Fedora
kernel
How to mitigate CVE-2015-8569
Install update from vendor's repository.
kernel - addressed in versions 4.3.3-200.fc22, 4.3.3-300.fc23
External References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=09ccfd238e5a0e670d8178cf50180ea81ae09ae1
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html
- http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.html
- http://lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.html
- http://twitter.com/grsecurity/statuses/676744240802750464
- http://www.debian.org/security/2016/dsa-3434
- http://www.openwall.com/lists/oss-security/2015/12/15/11
- http://www.securityfocus.com/bid/79428
- http://www.securitytracker.com/id/1034549
- http://www.ubuntu.com/usn/USN-2886-1
- http://www.ubuntu.com/usn/USN-2888-1
- http://www.ubuntu.com/usn/USN-2890-1
- http://www.ubuntu.com/usn/USN-2890-2
- http://www.ubuntu.com/usn/USN-2890-3
- https://bugzilla.redhat.com/show_bug.cgi?id=1292045
- https://github.com/torvalds/linux/commit/09ccfd238e5a0e670d8178cf50180ea81ae09ae1
- https://lkml.org/lkml/2015/12/14/252