CVE-2015-1805

What it actually does

The flaw in pipe_read and pipe_write allows local users to trigger I/O vector array overruns by failing to account for side effects of unsuccessful atomic user-space copy operations, resulting in memory corruption that can lead to denial of service or privilege escalation.

Why it matters to the business

Organizations running unpatched Linux kernels or Android devices face risk of system crashes or local attackers gaining elevated privileges, though the issue's age and low exploitation likelihood limit broad operational disruption.

How an attack unfolds

A local attacker crafts an application that performs pipe I/O operations designed to cause __copy_to_user_inatomic or __copy_from_user_inatomic failures, exploiting the resulting overrun to corrupt kernel memory and either crash the system or escalate privileges.

How to fix it

Upgrade the Linux kernel to version 3.16 or later; apply vendor patches for affected Android devices and rebuild or replace any custom kernels incorporating the vulnerable pipe.c code.

How to confirm the fix worked

Confirm kernel version is at least 3.16 via uname -r or equivalent; review distribution security advisories and changelogs for backported fixes; test pipe operations under load with known trigger patterns in a lab environment.

Typical attack path

1. Obtain local shell access on a vulnerable system
2. Execute a crafted binary that interacts with pipes using specific I/O vectors
3. Force failed atomic copy operations during pipe read/write
4. Leverage resulting memory corruption for denial of service or root access

How to detect it

Review kernel logs for oops, panics, or pipe-related crashes; search for processes exhibiting unusual pipe I/O patterns or memory faults around pipe operations.

What your security team should do

• Apply kernel updates immediately on all exposed Linux and Android systems
• Limit untrusted local accounts and sandbox applications where feasible
• Audit custom kernels and downstream distributions for inclusion of the fix
• Monitor EPSS and KEV status for any future changes in exploit availability