VYPR
← All advisories
Low severity2.3NVD Advisory· Published Dec 28, 2015· Updated May 6, 2026

CVE-2015-7884

CVE-2015-7884

Description

The vivid_fb_ioctl function in Linux kernel's vivid-osd driver leaks 16 uninitialized bytes of kernel memory to local users via the FBIOGET_VBLANK ioctl.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

The vivid_fb_ioctl function in Linux kernel's vivid-osd driver leaks 16 uninitialized bytes of kernel memory to local users via the FBIOGET_VBLANK ioctl.

Vulnerability

The vivid_fb_ioctl function in drivers/media/platform/vivid/vivid-osd.c in the Linux kernel through version 4.3.3 fails to initialize the reserved member of the struct fb_vblank structure before copying it to userspace. This affects the Virtual Video Test Driver (vivid), which is typically used for testing and development. The bug was introduced by commit eda98796aff0d9bf41094b06811f5def3b4c333c. [1][2]

Exploitation

An attacker needs only local access to the system and the ability to open the /dev/video device associated with the vivid driver. By issuing the FBIOGET_VBLANK ioctl on the device, the vivid_fb_ioctl function copies the uninitialized structure to user space without zeroing out the reserved bytes. No special privileges or race conditions are required beyond local access to the system. [1][2]

Impact

A successful exploit allows a local user to read 16 uninitialized bytes from kernel heap memory. This results in an information disclosure vulnerability (CIA impact: confidentiality). The leaked data could contain sensitive kernel information, though the content is unpredictable and depends on heap state. The vulnerability is considered low severity (CVSS 2.3) because it requires local access and only leaks a small amount of memory. [1][2]

Mitigation

The issue was fixed in Linux kernel version 4.4-rc1 with commit eda98796aff0d9bf41094b06811f5def3b4c333c, which correctly initializes struct fb_vblank before use. Ubuntu addressed it in USN-2843-1 (December 2015) for the Wily 15.10 kernel and USN-2843-2 for the Wily HWE kernel. Red Hat closed the bug as NOTABUG, likely because the vivid driver is not intended for production use. Users who do not need the vivid driver can blacklist it or ensure their kernel is updated to a patched version. [1][3][4]

References
  1. 1274726 – (CVE-2015-7884) CVE-2015-7884 kernel: media/vivid-osd: information leak in ioctl
  2. security - Re: CVE Request: Linux Kernel ioctl infoleaks on vivid-osd and dgnc
  3. USN-2843-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu
  4. USN-2843-2: Linux kernel (Wily HWE) vulnerabilities | Ubuntu security notices | Ubuntu

AI Insight generated on May 23, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected products

3

Patches

4
eda98796aff0

[media] media/vivid-osd: fix info leak in ioctl

https://github.com/torvalds/linuxSalva PeiróOct 7, 2015via nvd-ref
commit
1 file changed · +1 −0
  • drivers/media/platform/vivid/vivid-osd.c+1 −0 modified
    @@ -85,6 +85,7 @@ static int vivid_fb_ioctl(struct fb_info *info, unsigned cmd, unsigned long arg)
 	case FBIOGET_VBLANK: {
 		struct fb_vblank vblank;
 
+		memset(&vblank, 0, sizeof(vblank));
 		vblank.flags = FB_VBLANK_HAVE_COUNT | FB_VBLANK_HAVE_VCOUNT |
 			FB_VBLANK_HAVE_VSYNC;
 		vblank.count = 0;
eda98796aff0
https://git.kernel.org/pub/scm/cgit/linux/kernel/git/torvalds/linux.gitvia nvd-ref
commit
4b6184336ebb
https://git.kernel.org/pub/scm/cgit/linux/kernel/git/next/linux-next.gitvia body-scan
commit
eda98796aff0
https://git.kernel.org/pub/scm/cgit/linux/kernel/git/next/linux-next.gitvia body-scan
commit

Vulnerability mechanics

Root cause

"The vivid_fb_ioctl function fails to initialize a structure member, leading to information disclosure."

Attack vector

Local users with elevated privileges can trigger this vulnerability by calling the vivid_fb_ioctl function with a crafted application. The function is responsible for handling ioctl commands, and specifically, the FBIOGET_VBLANK case is affected. By not properly initializing the `fb_vblank` structure, uninitialized memory containing sensitive kernel data can be exposed.

Affected code

The vulnerability resides in the `vivid_fb_ioctl` function, located in the file `drivers/media/platform/vivid/vivid-osd.c`. Specifically, the code path handling the `FBIOGET_VBLANK` ioctl command is affected.

What the fix does

The patch introduces a `memset(0)` call before filling the `fb_vblank` structure within the `vivid_fb_ioctl` function [patch_id=4376390]. This ensures that all members of the structure, including the 16 reserved bytes, are initialized to zero. By zeroing out the structure, any previously uninitialized memory is cleared, preventing the disclosure of sensitive information from kernel memory.

Preconditions

  • authLocal users with elevated privileges are required.

Generated on Jun 1, 2026. Inputs: CWE entries + fix-commit diffs from this CVE's patches. Citations validated against bundle.

References

12

News mentions

0

No linked articles in our index yet.