Race condition in the handle_to_path function in fs/fhandle.c in the Linux kernel through 3.19.1 allows local users to bypass intended size restrictions and trigger read operations on additional memory locations by changing the handle_bytes value of a file handle during the execution of this function.
Source: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-1420
Reference (s):
- BID:72357
- URL: http://www.securityfocus.com/bid/72357
- https://bugzilla.redhat.com/show_bug.cgi?id=1187534
- DEBIAN:DSA-3170
- URL: http://www.debian.org/security/2015/dsa-3170