CVE-2015-8709

State: Published
Severity: Not scored
Published: Feb 8, 2016
Updated: Aug 6, 2024
Reserved: Dec 31, 2015

Description

kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here.

Scores

The record has no CVSS score.

Weaknesses

The record names no weakness.

Affected Products

Product	Versions
n/an/a	n/aAffected

References

SUSE-SU-2016:1038vendor-advisory
SUSE-SU-2016:1033vendor-advisory
SUSE-SU-2016:1034vendor-advisory
[linux-kernel] 20151226 [PATCH] ptrace: being capable wrt a process requires mapped uids/gidsmailing-list
SUSE-SU-2016:1035vendor-advisory
[linux-kernel] 20160106 Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gidsmailing-list
SUSE-SU-2016:1764vendor-advisory
SUSE-SU-2016:1031vendor-advisory
SUSE-SU-2016:1019vendor-advisory
[oss-security] 20151231 Re: CVE Request: Linux kernel: privilege escalation in user namespacesmailing-list
[oss-security] 20151217 CVE Request: Linux kernel: privilege escalation in user namespacesmailing-list
SUSE-SU-2016:1037vendor-advisory
SUSE-SU-2016:1045vendor-advisory
[linux-kernel] 20160106 Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gidsmailing-list
FEDORA-2016-5d43766e33vendor-advisory
SUSE-SU-2016:1032vendor-advisory
SUSE-SU-2016:1039vendor-advisory
SUSE-SU-2016:1041vendor-advisory
SUSE-SU-2016:1046vendor-advisory
79899vdb-entry
1034899vdb-entry
openSUSE-SU-2016:1008vendor-advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1295287
DSA-3434vendor-advisory
SUSE-SU-2016:1040vendor-advisory

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.