PT-2015-3393 · Linux+5 · Linux Kernel+5
Cong Wang
+1
·
Publicado
2015-12-17
·
Atualizado
2024-06-15
·
CVE-2015-8543
CVSS v3.1
7.0
Alta
| Vetor | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 4.3.3
Description
The issue is related to the networking implementation in the Linux kernel, which does not properly validate protocol identifiers for certain protocol families. This can be exploited by local users to cause a denial of service, resulting in a system crash due to a NULL function pointer dereference. It is also possible for attackers to gain privileges by executing a crafted SOCK RAW application, leveraging CLONE NEWUSER support. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
For Linux kernel versions through 4.3.3, update to a version newer than 4.3.3 to resolve the issue.
At the moment, there is no information about additional mitigation measures for this vulnerability.
Exploit
Correção
NULL Pointer Dereference
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu