CVE-2015-5707

What it actually does

Integer overflow in sg_start_req allows a large iov_count in a write request to the SCSI generic driver to trigger memory corruption or denial of service.

Why it matters to the business

Local attackers on affected Linux systems can crash servers or potentially execute code with kernel privileges, leading to downtime and data exposure on desktops, servers, and embedded devices still running vulnerable kernels.

How an attack unfolds

A local user with write access to /dev/sg* devices crafts a malicious write request containing an oversized iov_count value that overflows during length calculations in sg_start_req, resulting in out-of-bounds memory access and either a kernel panic or arbitrary memory corruption that can be leveraged for further privilege escalation.

How to fix it

Upgrade the Linux kernel to version 4.1 or later on all affected distributions; apply the vendor-supplied backported patch for the sg.c driver if a full kernel upgrade is not immediately possible; disable or restrict access to /dev/sg* devices for unprivileged users where feasible.

How to confirm the fix worked

Verify that the running kernel version is 4.1 or newer, confirm the sg_start_req function no longer contains the vulnerable integer arithmetic, and test that large iov_count requests are rejected or handled safely without kernel oops or corruption.

Typical attack path

1. Obtain a local shell or process on an affected Linux system
2. Open a handle to a SCSI generic device node
3. Issue a write system call with a crafted iovec array whose iov_count triggers the integer overflow
4. Exploit the resulting memory corruption to execute arbitrary code or cause denial of service

How to detect it

Review kernel logs for oops or panic entries referencing sg.c or sg_start_req around the time of suspected activity; examine process accounting and audit logs for unusual write operations to SCSI generic device nodes by non-root users.

What your security team should do

• Prioritize kernel upgrades on all internet-facing or multi-user Linux systems within the next maintenance window
• Audit systems for direct use of the SCSI generic driver and restrict device permissions
• Monitor for any remaining 2.6.x-4.0.x kernels in the environment and schedule immediate replacement