CVE-2015-8964

What it actually does

The tty_set_termios_ldisc function in drivers/tty/tty_ldisc.c allows local users to read uninitialized kernel memory contents through a tty data structure.

Why it matters to the business

Attackers with local access could leak sensitive kernel data such as credentials or encryption keys, enabling further system compromise on Linux hosts.

How an attack unfolds

A local attacker interacts with tty devices to invoke tty_set_termios_ldisc with crafted parameters, causing the kernel to expose portions of its memory via the returned data structure.

How to fix it

Upgrade the Linux kernel to version 4.5 or later where the tty_set_termios_ldisc function was corrected.

How to confirm the fix worked

Confirm the running kernel version is 4.5 or newer; review source for the patched tty_ldisc.c implementation if building from source.

Typical attack path

1. Gain local shell access on a vulnerable Linux system
2. Open or manipulate a tty device
3. Call set_termios with a new line discipline to trigger the flawed path
4. Read the tty structure to extract kernel memory contents

How to detect it

Review system audit logs for unusual tty line discipline changes or tty device interactions by non-administrative users; kernel memory access patterns are not directly logged.

What your security team should do

• Prioritize kernel updates on all Linux systems to 4.5+
• Restrict local user access where possible until patched
• Monitor kernel update channels for backported fixes in supported distributions