FPII-2605 : Elevation of privilege vulnerability in kernel security subsystem (device specific) CVE-2015-7872 A-31253168
The key_gc_unused_keys function in security/keys/gc.c,
in the Linux kernel through 4.2.6,
allows local users to potentially execute code via crafted keyctl commands.
The fix is designed to add additional checks to make sure the destroy function is only called if the key was successfully instantiated to prevent the potential code execution.
Change-Id: Icb1d87e29112ef74e9a726960a6e89c878fd1bfc
1 file changed