Home    |    View Topics    |    Search    |    Contact Us    |   



Category:   OS (Linux)  >   Linux Kernel Vendors:
(Red Hat Issues Fix) Linux Kernel key_gc_unused_keys() Garbage Collection Bug Lets Local Users Cause Denial of Service Conditions on the Target System
SecurityTracker Alert ID:  1035041
SecurityTracker URL:
CVE Reference:   CVE-2015-7872   (Links to External Site)
Date:  Feb 18 2016
Impact:   Denial of service via local system
Fix Available:  Yes  Vendor Confirmed:  Yes  
Version(s): RHEL 7
Description:   A vulnerability was reported in the Linux kernel. A local user can cause denial of service conditions on the target system.

A local user can supply a specially crafted keyctl command to trigger a garbage collection error in the keyring handler and cause the target system to crash.

The vulnerability resides in the key_gc_unused_keys() function in 'security/keys/gc.c'.

Dmitry Vyukov reported this vulnerability.

Impact:   A local user can cause the target system to crash.
Solution:   Red Hat has issued a fix.

The Red Hat advisory is available at:

Vendor URL: (Links to External Site)
Cause:   State error

Message History:   This archive entry is a follow-up to the message listed below.
Dec 17 2015 Linux Kernel key_gc_unused_keys() Garbage Collection Bug Lets Local Users Cause Denial of Service Conditions on the Target System

 Source Message Contents

Subject:  [RHSA-2016:0212-01] Important: kernel-rt security, bug fix, and enhancement update

Hash: SHA1

                   Red Hat Security Advisory

Synopsis:          Important: kernel-rt security, bug fix, and enhancement update
Advisory ID:       RHSA-2016:0212-01
Product:           Red Hat Enterprise Linux
Advisory URL:
Issue date:        2016-02-16
CVE Names:         CVE-2015-5157 CVE-2015-7872 

1. Summary:

Updated kernel-rt packages that fix two security issues, several bugs, and
add various enhancements are now available for Red Hat Enterprise Linux 7.

Red Hat Product Security has rated this update as having Important security
impact. Common Vulnerability Scoring System (CVSS) base scores, which give
detailed severity ratings, are available for each vulnerability from the
CVE links in the References section.

2. Relevant releases/architectures:

Red Hat Enterprise Linux Realtime (v. 7) - noarch, x86_64

3. Description:

The kernel-rt packages contain the Linux kernel, the core of any Linux
operating system.

* It was found that the Linux kernel's keys subsystem did not correctly
garbage collect uninstantiated keyrings. A local attacker could use this
flaw to crash the system or, potentially, escalate their privileges on the
system. (CVE-2015-7872, Important)

* A flaw was found in the way the Linux kernel handled IRET faults during
the processing of NMIs. An unprivileged, local user could use this flaw to
crash the system or, potentially (although highly unlikely), escalate their
privileges on the system. (CVE-2015-5157, Moderate)

The kernel-rt packages have been upgraded to version 3.10.0-327.10.1, which
provides a number of bug fixes and enhancements, including:

* [md] dm: fix AB-BA deadlock in __dm_destroy() 

* [md] revert "dm-mpath: fix stalls when handling invalid ioctl

* [cpufreq] intel_pstate: Fix limits->max_perf and limits->max_policy_pct
rounding errors

* [cpufreq] revert "intel_pstate: fix rounding error in max_freq_pct"

* [crypto] nx: 842 - Add CRC and validation support

* [of] return NUMA_NO_NODE from fallback of_node_to_nid()


This update also fixes the following bugs:

* Because the realtime kernel replaces most of the spinlocks with
rtmutexes, the locking scheme used in both NAPI polling and busy polling
could become out of synchronization with the State Machine they protected.
This could cause system performance degradation or even a livelock
situation when a machine with faster NICs (10g or 40g) was subject to a
heavy pressure receiving network packets. The locking schemes on NAPI
polling and busy polling routines have been hardened to enforce the State
machine sanity to help ensure the system continues to function properly
under pressure. (BZ#1293230)

* A possible livelock in the NAPI polling and busy polling routines could
lead the system to a livelock on threads running at high, realtime,
priorities. The threads running at priorities lower than the ones of the
threads involved in the livelock were prevented from running on the CPUs
affected by the livelock. Among those lower priority threads are the rcuc/
threads. With this update, right before (4 jiffies) a RCU stall is
detected, the rcuc/ threads on the CPUs facing the livelock have their
priorities boosted above the priority of the threads involved in the
livelock. The softirq code has also been updated to be more robust.
These modifications allow the rcuc/ threads to execute even under system
pressure, mitigating the RCU stalls. (BZ#1293229)

* Multiple CPUs trying to take an rq lock previously caused large latencies
on machines with many CPUs. On systems with more than 32 cores, this update
uses the "push" rather than "pull" approach and provides multiple changes
to the scheduling of rq locks. As a result, machines no longer suffer from
multiplied latencies on large CPU systems. (BZ#1282597)

* Previously, the SFC driver for 10 GB cards executed polling in NAPI mode,
using a locking mechanism similar to a "trylock". Consequently, when
running on a Realtime kernel, a livelock could occur. This update modifies
the locking mechanism so that once the lock is taken it is not released
until the operation is complete. (BZ#1282609)

All kernel-rt users are advised to upgrade to these updated packages, which
correct these issues and add these enhancements. The system must be
rebooted for this update to take effect.

4. Solution:

Before applying this update, make sure all previously released errata
relevant to your system have been applied.

For details on how to apply this update, refer to:

5. Bugs fixed (

1259577 - CVE-2015-5157 kernel: x86-64: IRET faults during NMIs processing
1272371 - CVE-2015-7872 kernel: Keyrings crash triggerable by unprivileged user
1282591 - kernel-rt: update to the RHEL7.2.z batch 2 source tree
1293229 - RCU stalls message on realtime kernel
1293230 - rt: netpoll: live lock with NAPI polling and busy polling on realtime kernel

6. Package List:

Red Hat Enterprise Linux Realtime (v. 7):




These packages are GPG signed by Red Hat for security.  Our key and
details on how to verify the signature are available from

7. References:

8. Contact:

The Red Hat security contact is <>. More contact
details at

Copyright 2016 Red Hat, Inc.
Version: GnuPG v1


RHSA-announce mailing list

Go to the Top of This SecurityTracker Archive Page

Home   |    View Topics   |    Search   |    Contact Us

This web site uses cookies for web analytics. Learn More

Copyright 2022, LLC