Denial of service in Linux kernel and linux_kernel (Debian package) - CVE-2015-1350
Published: May 16, 2017
Vulnerability identifier: #VU6551
CSH Severity: Low
CVSS v4: 4.8 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N]
CVE-ID: CVE-2015-1350
CWE-ID: CWE-264
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local attacker to cause DoS conditions on the target system.
The weakness exists due to underspecified removing of extended privilege attributes caused by incomplete set of requirements for setattr operations. A local can invoke chown or system call, trigger an error in notify_change for filesystem xattrs and cause the ping or Wireshark dumpcap program to crash.
Successful exploitation of the vulnerability results in denial of service.
The weakness exists due to underspecified removing of extended privilege attributes caused by incomplete set of requirements for setattr operations. A local can invoke chown or system call, trigger an error in notify_change for filesystem xattrs and cause the ping or Wireshark dumpcap program to crash.
Successful exploitation of the vulnerability results in denial of service.
Affected software
Linux kernel
SUSE Linux
Ubuntu
linux_kernel (Debian package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-208-powerpc-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-208-lowlatency (Ubuntu package)
linux-image-4.4.0-208-generic (Ubuntu package)
linux-image-4.4.0-208-generic-lpae (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1090-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1091-kvm (Ubuntu package)
linux-image-4.4.0-1126-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1150-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1154-snapdragon (Ubuntu package)
Oracle VM Server for x86
SUSE Linux
Ubuntu
linux_kernel (Debian package)
linux-image-virtual-lts-xenial (Ubuntu package)
linux-image-lowlatency-lts-xenial (Ubuntu package)
linux-image-generic-lts-xenial (Ubuntu package)
linux-image-generic-lpae-lts-xenial (Ubuntu package)
linux-image-generic-lpae (Ubuntu package)
linux-image-virtual (Ubuntu package)
linux-image-powerpc64-smp (Ubuntu package)
linux-image-powerpc64-emb (Ubuntu package)
linux-image-powerpc-smp (Ubuntu package)
linux-image-powerpc-e500mc (Ubuntu package)
linux-image-lowlatency (Ubuntu package)
linux-image-generic (Ubuntu package)
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package)
linux-image-4.4.0-208-powerpc-smp (Ubuntu package)
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package)
linux-image-4.4.0-208-lowlatency (Ubuntu package)
linux-image-4.4.0-208-generic (Ubuntu package)
linux-image-4.4.0-208-generic-lpae (Ubuntu package)
linux-image-aws (Ubuntu package)
linux-image-4.4.0-1090-aws (Ubuntu package)
linux-image-kvm (Ubuntu package)
linux-image-4.4.0-1091-kvm (Ubuntu package)
linux-image-4.4.0-1126-aws (Ubuntu package)
linux-image-raspi2 (Ubuntu package)
linux-image-4.4.0-1150-raspi2 (Ubuntu package)
linux-image-snapdragon (Ubuntu package)
linux-image-4.4.0-1154-snapdragon (Ubuntu package)
Oracle VM Server for x86
How to mitigate CVE-2015-1350
Install update from vendor's website.
linux-image-virtual-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lpae (Ubuntu package) - update to 4.4.0.208.214
linux-image-virtual (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.208.214
linux-image-lowlatency (Ubuntu package) - update to 4.4.0.208.214
linux-image-generic (Ubuntu package) - update to 4.4.0.208.214
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-lowlatency (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic-lpae (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1090.87, 4.4.0.1126.131
linux-image-4.4.0-1090-aws (Ubuntu package) - update to 4.4.0-1090.94
linux-image-kvm (Ubuntu package) - update to 4.4.0.1091.89
linux-image-4.4.0-1091-kvm (Ubuntu package) - update to 4.4.0-1091.100
linux-image-4.4.0-1126-aws (Ubuntu package) - update to 4.4.0-1126.140
linux-image-raspi2 (Ubuntu package) - update to 4.4.0.1150.150
linux-image-4.4.0-1150-raspi2 (Ubuntu package) - update to 4.4.0-1150.161
linux-image-snapdragon (Ubuntu package) - update to 4.4.0.1154.146
linux-image-4.4.0-1154-snapdragon (Ubuntu package) - update to 4.4.0-1154.164
linux-image-lowlatency-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lpae-lts-xenial (Ubuntu package) - update to 4.4.0.208.181
linux-image-generic-lpae (Ubuntu package) - update to 4.4.0.208.214
linux-image-virtual (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc64-emb (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-smp (Ubuntu package) - update to 4.4.0.208.214
linux-image-powerpc-e500mc (Ubuntu package) - update to 4.4.0.208.214
linux-image-lowlatency (Ubuntu package) - update to 4.4.0.208.214
linux-image-generic (Ubuntu package) - update to 4.4.0.208.214
linux-image-4.4.0-208-powerpc64-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc64-emb (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-smp (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-powerpc-e500mc (Ubuntu package) - update to 4.4.0-208.240
linux-image-4.4.0-208-lowlatency (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-4.4.0-208-generic-lpae (Ubuntu package) - update to 4.4.0-208.240~14.04.1
linux-image-aws (Ubuntu package) - addressed in versions 4.4.0.1090.87, 4.4.0.1126.131
linux-image-4.4.0-1090-aws (Ubuntu package) - update to 4.4.0-1090.94
linux-image-kvm (Ubuntu package) - update to 4.4.0.1091.89
linux-image-4.4.0-1091-kvm (Ubuntu package) - update to 4.4.0-1091.100
linux-image-4.4.0-1126-aws (Ubuntu package) - update to 4.4.0-1126.140
linux-image-raspi2 (Ubuntu package) - update to 4.4.0.1150.150
linux-image-4.4.0-1150-raspi2 (Ubuntu package) - update to 4.4.0-1150.161
linux-image-snapdragon (Ubuntu package) - update to 4.4.0.1154.146
linux-image-4.4.0-1154-snapdragon (Ubuntu package) - update to 4.4.0-1154.164