CVE-2015-7550

What it actually does

Race condition in keyctl_read_key allows NULL pointer dereference via concurrent keyctl_revoke and keyctl_read calls on the same key.

Why it matters to the business

Local users can crash Linux systems, causing unplanned downtime and potential loss of availability on servers and workstations.

How an attack unfolds

An attacker compiles a program that rapidly alternates keyctl_revoke and keyctl_read operations on a key the process controls, winning the race to trigger the NULL dereference before the kernel update in 4.3.4.

How to fix it

Upgrade the Linux kernel to version 4.3.4 or newer; apply vendor backports where available for supported distributions.

How to confirm the fix worked

Verify running kernel version is at least 4.3.4; attempt to reproduce the race condition in a controlled test environment and confirm absence of crash.

Typical attack path

1. Obtain local unprivileged access to a Linux system
2. Create or reference a keyring entry
3. Execute crafted binary that triggers concurrent revoke/read keyctl calls
4. Trigger kernel NULL dereference resulting in panic or oops

How to detect it

Search kernel logs and crash dumps for NULL pointer dereference entries referencing keyctl_read_key or keyctl.c around the time of system instability.

• keyctl_read_key
• security/keys/keyctl.c
• NULL pointer dereference.*keyctl

What your security team should do

• Prioritize kernel updates on all Linux hosts
• Review and restrict unprivileged keyctl usage via SELinux or AppArmor policies where possible
• Monitor kernel logs for key-related oops messages