PT-2015-6382 · Linux+3 · Linux Kernel+3

Published

2015-06-07

·

Updated

2016-12-28

·

CVE-2015-4001

CVSS v2.0

9.0

High

VectorAV:N/AC:L/Au:N/C:P/I:P/A:C
Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.0.6
Description The issue is related to an integer signedness error in the oz hcd get desc cnf function. This error can be exploited by remote attackers, potentially leading to a denial of service or arbitrary code execution via a crafted packet.
Recommendations For Linux kernel versions prior to 4.0.6, update to version 4.0.6 or later to resolve the issue. As a temporary workaround, consider restricting access to the oz hcd get desc cnf function in the OZWPAN driver to minimize the risk of exploitation.

Exploit

Fix

DoS

Found an issue in the description? Have something to add? Feel free to write us 👾
dbugs@ptsecurity.com

Weakness Enumeration

CWE-189

Related Identifiers

ALT-PU-2015-1564
ALT-PU-2015-1849
CVE-2015-4001
OPENSUSE-SU-2015_1382-1
OPENSUSE-SU-2016_0301-1
USN-2662-1
USN-2663-1
USN-2664-1
USN-2665-1
USN-2666-1
USN-2667-1

Affected Products

Alt Linux
Linux Kernel
Suse
Ubuntu