PT-2016-4070 · Linux+2 · Linux Kernel+2

Published 2015-08-12 · Updated 2023-10-05 · CVE-2015-8955

Positive Technologies (AI Summary)

CVSS v3.1

7.3

High

Base vector

AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.1

Description The issue allows local users to gain privileges or cause a denial of service due to invalid pointer dereference. This occurs through vectors involving events that are mishandled during a span of multiple HW PMUs on arm64 platforms.

Recommendations For Linux kernel versions prior to 4.1, update to version 4.1 or later to resolve the issue. As a temporary workaround, consider restricting access to performance monitoring events to minimize the risk of exploitation.

Exploit

Fix

DoS

Weakness Enumeration

CWE-264

Related Identifiers

ALT-PU-2015-1678

ALT-PU-2015-1849

CVE-2015-8955

USN-3360-1

USN-3360-2

Affected Products

Alt Linux

Linux Kernel

Ubuntu

References · 40

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/overlayfs_priv_esc.rb · Exploit
• 🔥 https://github.com/fi01/CVE-2015-3636 · Exploit
• 🔥 https://github.com/android-rooting-tools/libpingpong_exploit · Exploit
• 🔥 https://github.com/a7vinx/CVE-2015-3636 · Exploit
• 🔥 https://github.com/askk/libping_unhash_exploit_POC · Exploit
• 🔥 https://github.com/hhj4ck/CVE-2016-2067 · Exploit
• 🔥 https://github.com/0x1ns4n3/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/elit3pwner/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/x1ns4n3/CVE-2015-1328-GoldenEye · Exploit
• 🔥 https://github.com/betalphafai/CVE-2015-0568 · Exploit
• 🔥 https://github.com/betalphafai/cve-2015-3636_crash · Exploit
• https://github.com/torvalds/linux/commit/8fff105e13041e49b82f92eef034f363a6b1c071 · Patch
• https://ubuntu.com/security/CVE-2015-8962 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3360-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8955 · Vendor Advisory