PT-2015-6820 · Linux+2 · Linux Kernel+2

Moein Ghasemzadeh · Published 2015-09-24 · Updated 2023-02-12 · CVE-2015-5257

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Medium

Base vector

AV:L/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.2.4

Description The issue allows physically proximate attackers to cause a denial of service (NULL pointer dereference and OOPS) or possibly have unspecified other impact via a crafted USB device. This is due to a flaw in the drivers/usb/serial/whiteheat.c file.

Recommendations For Linux kernel versions prior to 4.2.4, update to version 4.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to USB devices to minimize the risk of exploitation.

Exploit

Fix

Related Identifiers

ALT-PU-2015-1924

ALT-PU-2016-1485

CVE-2015-5257

DLA-325-1

DSA-3372-1

MGASA-2015-0435

MGASA-2015-0439

MGASA-2016-0015

MGASA-2016-0225

MGASA-2016-0232

MGASA-2016-0233

USN-2792-1

USN-2794-1

USN-2795-1

USN-2796-1

USN-2797-1

USN-2798-1

USN-2799-1

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 98

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/overlayfs_priv_esc.rb · Exploit
• 🔥 https://github.com/xairy/kernel-exploits/tree/master/CVE-2016-2384 · Exploit
• 🔥 https://github.com/Kagami/docker_cve-2015-2925 · Exploit
• 🔥 https://github.com/whu-enjoy/CVE-2015-8660 · Exploit
• https://github.com/torvalds/linux/commit/cbb4be652d374f64661137756b8f357a1827d6a4 · Vendor Advisory
• http://ubuntu.com/usn/USN-2792-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0439.html · Security Note
• http://ubuntu.com/usn/USN-2799-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0232.html · Security Note
• https://advisories.mageia.org/MGASA-2015-0435.html · Security Note
• https://osv.dev/vulnerability/MGASA-2016-0233 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2015-5257 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2794-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2016-0225.html · Security Note
• https://ubuntu.com/security/CVE-2015-5257 · Vendor Advisory