CVE-2015-5231

The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.

Score

CVSS 3.0 5.5 Medium

Status

Modified - secalert@redhat.com

Published

2016-06-07

Last modified

2024-08-06

Weaknesses

CWE-200

Affected products

• Checkpoint/restore In Userspace (Criu)
• Opensuse (Opensuse)

References

• http://lists.opensuse.org/opensuse-updates/2015-09/msg00030.html
• http://www.openwall.com/lists/oss-security/2015/08/25/5
• https://bugzilla.redhat.com/show_bug.cgi?id=1256728
• https://lists.openvz.org/pipermail/criu/2015-August/021847.html