CVE-2015-5697

What it actually does

Uninitialized bitmap data structure in get_bitmap_file allows leakage of uninitialized kernel memory contents to userspace via GET_BITMAP_FILE ioctl on md devices.

Why it matters to the business

Local attackers on affected Linux systems can read sensitive kernel memory contents, potentially exposing credentials, keys, or other internal data; high ecosystem prevalence means many servers and devices remain at risk years after disclosure.

How an attack unfolds

A local user with access to an md device issues the GET_BITMAP_FILE ioctl; the uninitialized structure returns kernel memory contents directly to the caller.

How to fix it

Upgrade the Linux kernel to version 4.1.6 or later; apply vendor backports for supported distributions; disable unnecessary md/RAID device access where feasible.

How to confirm the fix worked

Verify running kernel version is 4.1.6 or newer; test that GET_BITMAP_FILE ioctl returns initialized data only; review kernel build logs for the md.c patch.

Typical attack path

1. Obtain local shell or process execution on target Linux system
2. Locate or create an md device node
3. Invoke GET_BITMAP_FILE ioctl with appropriate arguments
4. Read and parse returned data for sensitive kernel memory artifacts

How to detect it

Search process execution logs and audit trails for repeated ioctl calls to md devices by non-root users; examine memory dumps or process core files for patterns consistent with kernel memory leakage.

What your security team should do

• Prioritize kernel upgrades on internet-facing and multi-tenant systems first
• Audit local user access to md devices and restrict where possible
• Monitor for new local privilege-escalation chains leveraging this disclosure
• Schedule periodic kernel version baselining across the fleet