Vulnerabilities > CVE-2015-5327 - Out-of-bounds Read vulnerability in Linux Kernel 4.3
Attack vector
NETWORK Attack complexity
LOW Privileges required
LOW Confidentiality impact
HIGH Integrity impact
NONE Availability impact
NONE Summary
Out-of-bounds memory read in the x509_decode_time function in x509_cert_parser.c in Linux kernels 4.3-rc1 and after.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| OS | 8 |
Common Weakness Enumeration (CWE)
Common Attack Pattern Enumeration and Classification (CAPEC)
- Overread Buffers An adversary attacks a target by providing input that causes an application to read beyond the boundary of a defined buffer. This typically occurs when a value influencing where to start or stop reading is set to reflect positions outside of the valid memory location of the buffer. This type of attack may result in exposure of sensitive information, a system crash, or arbitrary code execution.
Nessus
NASL family OracleVM Local Security Checks NASL id ORACLEVM_OVMSA-2019-0022.NASL description The remote OracleVM system is missing necessary patches to address critical security updates : - scsi: libfc: sanitize E_D_TOV and R_A_TOV setting (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: use configured rport E_D_TOV (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: additional debugging messages (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: don last seen 2020-06-01 modified 2020-06-02 plugin id 125615 published 2019-05-31 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125615 title OracleVM 3.4 : Unbreakable / etc (OVMSA-2019-0022) NASL family Oracle Linux Local Security Checks NASL id ORACLELINUX_ELSA-2019-4642.NASL description Description of changes: [4.1.12-124.27.1.el6uek] - scsi: libfc: sanitize E_D_TOV and R_A_TOV setting (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: use configured rport E_D_TOV (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: additional debugging messages (Hannes Reinecke) [Orabug: 25933179] - scsi: libfc: don last seen 2020-06-01 modified 2020-06-02 plugin id 125235 published 2019-05-17 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/125235 title Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2019-4642) NASL family Huawei Local Security Checks NASL id EULEROS_SA-2019-1527.NASL description According to the versions of the kernel packages installed, the EulerOS Virtualization for ARM 64 installation on the remote host is affected by the following vulnerabilities : - The Linux kernel, before version 4.14.3, is vulnerable to a denial of service in drivers/md/dm.c:dm_get_from_kobject() which can be caused by local users leveraging a race condition with __dm_destroy() during creation and removal of DM devices. Only privileged local users (with CAP_SYS_ADMIN capability) can directly perform the ioctl operations for dm device creation and removal and this would typically be outside the direct control of the unprivileged attacker.(CVE-2017-18203i1/4%0 - The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.(CVE-2014-9428i1/4%0 - The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.(CVE-2014-9940i1/4%0 - The Linux kernel before 3.12, when UDP Fragmentation Offload (UFO) is enabled, does not properly initialize certain data structures, which allows local users to cause a denial of service (memory corruption and system crash) or possibly gain privileges via a crafted application that uses the UDP_CORK option in a setsockopt system call and sends both short and long packets, related to the ip_ufo_append_data function in net/ipv4/ip_output.c and the ip6_ufo_append_data function in net/ipv6/ip6_output.c.(CVE-2013-4470i1/4%0 - A use-after-free flaw was found in the way the Linux kernel last seen 2020-03-19 modified 2019-05-14 plugin id 124980 published 2019-05-14 reporter This script is Copyright (C) 2019-2020 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/124980 title EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1527)
References
- http://www.openwall.com/lists/oss-security/2015/11/27/1
- http://www.openwall.com/lists/oss-security/2015/11/27/1
- https://bugzilla.redhat.com/show_bug.cgi?id=1278978
- https://bugzilla.redhat.com/show_bug.cgi?id=1278978
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc25b994acfbc901429da682d0f73c190e960206
- https://git.kernel.org/pub/scm/linux/kernel/git/torvalds/linux.git/commit/?id=cc25b994acfbc901429da682d0f73c190e960206