PT-2015-6154 · Linux+5 · Linux Kernel+5

Prasad Pandit

·

Publicado

2015-03-27

·

Atualizado

2023-01-19

·

CVE-2015-3331

CVSS v2.0

9.3

Alta

VetorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.19.3
Description The issue is related to the driver rfc4106 decrypt function in the Linux kernel, which does not properly determine the memory locations used for encrypted data. This allows attackers to cause a denial of service, such as a buffer overflow and system crash, or possibly execute arbitrary code by triggering a crypto API call.
Recommendations For Linux kernel versions prior to 3.19.3, update to version 3.19.3 or later to resolve the issue. As a temporary workaround, consider restricting access to the crypto API to minimize the risk of exploitation.

Exploit

Correção

DoS

Buffer Overflow

Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
dbugs@ptsecurity.com

Enumeração de Fraquezas

CWE-119

Identificadores relacionados

ALT-PU-2015-1325
ALT-PU-2015-1326
CESA-2015_0987
CESA-2015_1081
CVE-2015-3331
DSA-3237-1
MGASA-2015-0171
MGASA-2015-0172
MGASA-2015-0219
RHSA-2015:0981
RHSA-2015:0987
RHSA-2015:0989
RHSA-2015:1081
RHSA-2015:1199
RHSA-2015_0981
RHSA-2015_0987
RHSA-2015_1081
SUSE-RU-2015:0621-1
SUSE-SU-2015:0581-1
SUSE-SU-2015:0736-1
SUSE-SU-2015:1071-1
SUSE-SU-2015:1174-1
SUSE-SU-2015:1376-1
SUSE-SU-2015:1478-1
SUSE-SU-2015:1487-1
SUSE-SU-2015:1488-1
SUSE-SU-2015:1489-1
SUSE-SU-2015:1491-1
USN-2613-1
USN-2614-1
USN-2615-1
USN-2616-1
USN-2631-1
USN-2632-1

Produtos afetados

Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu