Race condition in the IPC object implementation in the Linux...

Vulnerability Description

Race condition in the IPC object implementation in the Linux kernel through 4.2.3 allows local users to gain privileges by triggering an ipc_addid call that leads to uid and gid comparisons against uninitialized data, related to msg.c, shm.c, and util.c.

References

• http://rhn.redhat.com/errata/RHSA-2015-2636.html
• http://www.debian.org/security/2015/dsa-3372
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00030.html
• http://www.ubuntu.com/usn/USN-2765-1
• http://www.ubuntu.com/usn/USN-2792-1
• http://www.ubuntu.com/usn/USN-2762-1
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00029.html
• http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
• https://github.com/torvalds/linux/commit/b9a532277938798b53178d5a66af6e2915cb27cf
• http://www.ubuntu.com/usn/USN-2763-1
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• http://www.securitytracker.com/id/1034094
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b9a532277938798b53178d5a66af6e2915cb27cf
• http://www.securitytracker.com/id/1034592
• https://kc.mcafee.com/corporate/index?page=content&id=SB10146
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• https://bugzilla.redhat.com/show_bug.cgi?id=1268270
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00032.html
• http://www.ubuntu.com/usn/USN-2764-1
• http://www.openwall.com/lists/oss-security/2015/10/01/8
• http://www.securityfocus.com/bid/76977
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00026.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00027.html
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00028.html
• http://www.ubuntu.com/usn/USN-2761-1
• http://lists.opensuse.org/opensuse-security-announce/2015-11/msg00031.html