Buffer overflow in Linux kernel - CVE-2015-5156
Published: December 21, 2016 / Updated: April 17, 2018
Vulnerability identifier: #VU2552
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:A/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-5156
CWE-ID: CWE-120
Exploitation vector: Adjecent network
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows an adjacent attacker to cause DoS condition on the target system.
The weakness exists in the virtnet_probe function in drivers/net/virtio_net.c due to attempts to support a FRAGLIST feature without proper memory allocation. An adjacent attacker can submit a specially crafted sequence of fragmented packets, trigger buffer overflow and cause the service to crash.
The weakness exists in the virtnet_probe function in drivers/net/virtio_net.c due to attempts to support a FRAGLIST feature without proper memory allocation. An adjacent attacker can submit a specially crafted sequence of fragmented packets, trigger buffer overflow and cause the service to crash.
Affected software
Linux kernel
SUSE Linux
Fedora
kernel
SUSE Linux
Fedora
kernel
How to mitigate CVE-2015-5156
Update to version 4.2.
kernel - addressed in versions 4.1.12-100.fc21, 4.1.12-101.fc21, 4.2.3-200.fc22