CVE

Id
85986  
CVE No.
CVE-2015-8709  
Status
Candidate  
Description
** DISPUTED ** kernel/ptrace.c in the Linux kernel through 4.4.1 mishandles uid and gid mappings, which allows local users to gain privileges by establishing a user namespace, waiting for a root process to enter that namespace with an unsafe uid or gid, and then using the ptrace system call. NOTE: the vendor states "there is no kernel bug here."  
Phase
Assigned (20151231)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
756214 85986 CVE-2015-8709 MLIST:[linux-kernel] 20151226 [PATCH] ptrace: being capable wrt a process requires mapped uids/gids  View
756215 85986 CVE-2015-8709 URL:https://lkml.org/lkml/2015/12/25/71  View
756216 85986 CVE-2015-8709 MLIST:[linux-kernel] 20160106 Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids  View
756217 85986 CVE-2015-8709 URL:http://marc.info/?l=linux-kernel&m=145204641422813&w=2  View
756218 85986 CVE-2015-8709 MLIST:[linux-kernel] 20160106 Re: [PATCH] ptrace: being capable wrt a process requires mapped uids/gids  View
756219 85986 CVE-2015-8709 URL:http://marc.info/?l=linux-kernel&m=145204362722256&w=2  View
756220 85986 CVE-2015-8709 MLIST:[oss-security] 20151217 CVE Request: Linux kernel: privilege escalation in user namespaces  View
756221 85986 CVE-2015-8709 URL:http://www.openwall.com/lists/oss-security/2015/12/17/12  View
756222 85986 CVE-2015-8709 MLIST:[oss-security] 20151231 Re: CVE Request: Linux kernel: privilege escalation in user namespaces  View
756223 85986 CVE-2015-8709 URL:http://www.openwall.com/lists/oss-security/2015/12/31/5  View
756224 85986 CVE-2015-8709 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1295287  View
756225 85986 CVE-2015-8709 FEDORA:FEDORA-2016-5d43766e33  View
756226 85986 CVE-2015-8709 URL:http://lists.fedoraproject.org/pipermail/package-announce/2016-February/176484.html  View
756227 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1764  View
756228 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-07/msg00005.html  View
756229 85986 CVE-2015-8709 SUSE:openSUSE-SU-2016:1008  View
756230 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html  View
756231 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1019  View
756232 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00019.html  View
756233 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1031  View
756234 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00025.html  View
756235 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1032  View
756236 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00026.html  View
756237 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1033  View
756238 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00027.html  View
756239 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1034  View
756240 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00028.html  View
756241 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1035  View
756242 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00029.html  View
756243 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1037  View
756244 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00030.html  View
756245 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1038  View
756246 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00031.html  View
756247 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1039  View
756248 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00032.html  View
756249 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1040  View
756250 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00033.html  View
756251 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1041  View
756252 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00034.html  View
756253 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1045  View
756254 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00036.html  View
756255 85986 CVE-2015-8709 SUSE:SUSE-SU-2016:1046  View
756256 85986 CVE-2015-8709 URL:http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00037.html  View
756257 85986 CVE-2015-8709 BID:79899  View
756258 85986 CVE-2015-8709 URL:http://www.securityfocus.com/bid/79899  View
756259 85986 CVE-2015-8709 SECTRACK:1034899  View

Related JVN

Id JVN No. Title Summary CVE No. CVE Id CVSS_v2 CVSS_v3 JVN URL Actions
11424 JVNDB-2015-006744 Drupal 用 Values モジュールにおける任意の PHP コードを実行される脆弱性 Drupal 用 Values モジュールは、パーミッションを適切にチェックしないため、任意の PHP コードを実行される脆弱性が存在します。 CVE-2015-8761 85986 6 http://jvndb.jvn.jp/ja/contents/2015/JVNDB-2015-006744.html  View