Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-7312: Linux kernel aufs patches may let users crash system

CVE-2015-7312 · published 11 years ago

Summary

The aufs file‑system patches used in Linux kernel version 3 and 4 allow a local user to trigger a race condition that can crash the machine or, in some cases, give the user higher privileges. This problem exists on systems that run the affected kernel patches, such as Ubuntu and Debian installations. Install the latest kernel updates from your Linux distribution or disable the aufs patches until they are fixed.

What to do

Update canonical linux to version 3.13.0-66.108.
Update canonical linux-lts-utopic to version 3.16.0-51.69~14.04.1.
Update canonical linux-lts-vivid to version 3.19.0-31.36~14.04.1.

Affected software

Ecosystem	Vendor	Product	Affected versions
–	linux	linux_kernel	>= 3.0.0, <= 3.19.8 >= 4.0.0, <= 4.20.15 `cpe:2.3:o:linux:linux_kernel::::::::`
–	canonical	ubuntu_linux	14.04 `cpe:2.3:o:canonical:ubuntu_linux:14.04::::esm:::`
–	debian	debian_linux	8.0 `cpe:2.3:o:debian:debian_linux:8.0:::::::*`
Ubuntu:14.04:LTS	canonical	linux	< 3.13.0-66.108 Fix: upgrade to 3.13.0-66.108
Ubuntu:14.04:LTS	canonical	linux-lts-utopic	< 3.16.0-51.69~14.04.1 Fix: upgrade to 3.16.0-51.69~14.04.1
Ubuntu:14.04:LTS	canonical	linux-lts-vivid	< 3.19.0-31.36~14.04.1 Fix: upgrade to 3.19.0-31.36~14.04.1

Original advisory text

Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.

References

http://www.debian.org/security/2015/dsa-3364 Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/09/22/10 Mailing List Third Party Advisory
http://www.ubuntu.com/usn/USN-2777-1 Third Party Advisory
http://sourceforge.net/p/aufs/mailman/message/34449209/ Third Party Advisory
https://ubuntu.com/security/CVE-2015-7312 Third Party Advisory
http://www.openwall.com/lists/oss-security/2015/09/10/3 Third Party Advisory
https://ubuntu.com/security/notices/USN-2776-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-2775-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-2777-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-2778-1 Vendor Advisory
https://ubuntu.com/security/notices/USN-2779-1 Vendor Advisory
https://www.cve.org/CVERecord?id=CVE-2015-7312 Third Party Advisory

Fix within

Internet-facing 60 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker partial control (estimated)

Severity

4.4 Medium

Exploitation

<1% chance of attack within 30 days

Type

CWE-362Race Condition

CWE-416Use After Free

Timeline

Published23 Sep 2015

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2015-7312 · NVD

UBUNTU-CVE-2015-7312 · OSV

Track software like this

Free during beta