CVE-2015-0274
Published: 16 March 2015
The XFS implementation in the Linux kernel before 3.15 improperly uses an old size value during remote attribute replacement, which allows local users to cause a denial of service (transaction overrun and data corruption) or possibly gain privileges by leveraging XFS filesystem access.
From the Ubuntu Security Team
Eric Windisch discovered flaw in how the Linux kernel's XFS file system replaces remote attributes. A local access with access to an XFS file system could exploit this flaw to escalate their privileges.
Notes
Author | Note |
---|---|
jdstrand | android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.10 and earlier preview kernels linux-lts-saucy no longer receives official support linux-lts-quantal no longer receives official support |
tyhicks | Introduced in v3.11-rc1 and fixed in v3.15-rc5 According to Red Hat, local priv escalation is possible |
Priority
Status
Package | Release | Status |
---|---|---|
linux Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
|
precise |
Not vulnerable
|
|
trusty |
Released
(3.13.0-48.80)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Not vulnerable
(3.15.0-1.5)
|
|
vivid |
Not vulnerable
(3.16.0-23.31)
|
|
wily |
Not vulnerable
(3.19.0-15.15)
|
|
Patches: Introduced by e461fcb194172b3f709e0b478d2ac1bdac7ab9a3 |
||
linux-armadaxp Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Not vulnerable
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
This package is not directly supported by the Ubuntu Security Team | ||
linux-ec2 Launchpad, Ubuntu, Debian |
lucid |
Not vulnerable
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-flo Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
linux-fsl-imx51 Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-goldfish Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
linux-grouper Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Ignored
(end of life)
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-linaro-omap Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-linaro-shared Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-linaro-vexpress Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-quantal Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Not vulnerable
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
This package is not directly supported by the Ubuntu Security Team | ||
linux-lts-raring Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life, was needs-triage)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-saucy Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Ignored
(end of life, was pending)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
This package is not directly supported by the Ubuntu Security Team | ||
linux-lts-trusty Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Released
(3.13.0-48.80~precise1)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-utopic Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.16.0-25.33~14.04.2])
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-lts-vivid Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was not-affected [3.19.0-18.18~14.04.1])
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-maguro Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-mako Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
linux-manta Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Does not exist
|
|
trusty |
Does not exist
(trusty was ignored)
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Not vulnerable
|
|
vivid |
Not vulnerable
|
|
wily |
Not vulnerable
|
|
linux-mvl-dove Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Does not exist
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-qcm-msm Launchpad, Ubuntu, Debian |
lucid |
Ignored
(end of life)
|
precise |
Ignored
(end of life)
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|
|
linux-raspi2 Launchpad, Ubuntu, Debian |
precise |
Does not exist
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
vivid |
Does not exist
|
|
wily |
Not vulnerable
(4.2.0-1008.12)
|
|
linux-ti-omap4 Launchpad, Ubuntu, Debian |
lucid |
Does not exist
|
precise |
Not vulnerable
|
|
trusty |
Does not exist
|
|
upstream |
Released
(3.15~rc5)
|
|
utopic |
Does not exist
|
|
vivid |
Does not exist
|
|
wily |
Does not exist
|