UBUNTU-CVE-2015-1350

Details

The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.

Affected Packages(17 packages)

linux

Ubuntu 16.04 LTS

Fixed in:

4.4.0-208.240

linux-aws

Ubuntu 16.04 LTS

Fixed in:

4.4.0-1126.140

linux-hwe

Ubuntu 16.04 LTS

Fixed in:

4.10.0-32.36~16.04.1

linux-kvm

Ubuntu 16.04 LTS

Fixed in:

4.4.0-1091.100

linux-raspi2

Ubuntu 16.04 LTS

Fixed in:

4.4.0-1150.161

linux-snapdragon

Ubuntu 16.04 LTS

Fixed in:

4.4.0-1154.164

linux-snapdragon

Ubuntu 18.04 LTS

Fixed in:

4.15.0-1053.57

linux-azure-fde

Ubuntu 20.04 LTS

Affected versions:

5.4.0-1063.66+cvm2.25.4.0-1063.66+cvm3.25.4.0-1064.67+cvm1.15.4.0-1065.68+cvm2.15.4.0-1067.70+cvm1.15.4.0-1068.71+cvm1.15.4.0-1069.72+cvm1.15.4.0-1070.73+cvm1.15.4.0-1072.75+cvm1.15.4.0-1073.76+cvm1.1+16 more

linux-intel-iot-realtime

Ubuntu 22.04 LTS

Affected versions:

5.15.0-1073.75

linux-realtime

Ubuntu 22.04 LTS

Affected versions:

5.15.0-1032.35

References

REPORT

https://ubuntu.com/security/CVE-2015-1350

ADVISORY

https://ubuntu.com/security/notices/USN-3361-1

ADVISORY

https://ubuntu.com/security/notices/USN-4904-1

REPORT

https://www.cve.org/CVERecord?id=CVE-2015-1350