PT-2015-3393 · Linux+5 · Linux Kernel+5
Cong Wang
+1
·
Published
2015-12-17
·
Updated
2024-06-15
·
CVE-2015-8543
CVSS v3.1
7.0
High
| Vector | AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Linux kernel versions through 4.3.3
Description
The issue is related to the networking implementation in the Linux kernel, which does not properly validate protocol identifiers for certain protocol families. This can be exploited by local users to cause a denial of service, resulting in a system crash due to a NULL function pointer dereference. It is also possible for attackers to gain privileges by executing a crafted SOCK RAW application, leveraging CLONE NEWUSER support. The vulnerability may allow an attacker to access confidential data, compromise its integrity, and cause a denial of service.
Recommendations
For Linux kernel versions through 4.3.3, update to a version newer than 4.3.3 to resolve the issue.
At the moment, there is no information about additional mitigation measures for this vulnerability.
Exploit
Fix
NULL Pointer Dereference
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Alt Linux
Centos
Linux Kernel
Red Hat
Suse
Ubuntu