CVE-2015-1421

high
New! CVE Severity Now Using CVSS v3

The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.

Description

Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=600ddd6825543962fb807884169e57b580dba208

http://lists.opensuse.org/opensuse-security-announce/2015-05/msg00001.html

http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html

http://rhn.redhat.com/errata/RHSA-2015-0726.html

http://rhn.redhat.com/errata/RHSA-2015-0751.html

http://rhn.redhat.com/errata/RHSA-2015-0782.html

http://rhn.redhat.com/errata/RHSA-2015-0864.html

http://rhn.redhat.com/errata/RHSA-2015-1082.html

http://www.debian.org/security/2015/dsa-3170

http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.8

http://www.openwall.com/lists/oss-security/2015/01/29/15

http://www.securityfocus.com/bid/72356

http://www.securitytracker.com/id/1032172

http://www.ubuntu.com/usn/USN-2541-1

http://www.ubuntu.com/usn/USN-2542-1

http://www.ubuntu.com/usn/USN-2545-1

http://www.ubuntu.com/usn/USN-2546-1

http://www.ubuntu.com/usn/USN-2562-1

http://www.ubuntu.com/usn/USN-2563-1

https://bugzilla.redhat.com/show_bug.cgi?id=1196581

https://github.com/torvalds/linux/commit/600ddd6825543962fb807884169e57b580dba208

Details

Source: MITRE

Published: 2015-03-16

Updated: 2018-01-05

Risk Information

CVSS v2

Base Score: 10

Vector: AV:N/AC:L/Au:N/C:C/I:C/A:C

Impact Score: 10

Exploitability Score: 10

Severity: HIGH

Vulnerable Software

Configuration 1

OR

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to 3.18.7 (inclusive)

Tenable Plugins

View all (37 total)

IDNameProductFamilySeverity
124987EulerOS Virtualization for ARM 64 3.0.1.0 : kernel (EulerOS-SA-2019-1534)NessusHuawei Local Security Checks
high
124809EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1485)NessusHuawei Local Security Checks
high
99163OracleVM 3.3 : Unbreakable / etc (OVMSA-2017-0057) (Dirty COW)NessusOracleVM Local Security Checks
critical
90019OracleVM 3.2 : kernel-uek (OVMSA-2016-0037)NessusOracleVM Local Security Checks
critical
88545openSUSE Security Update : the Linux Kernel (openSUSE-2016-124)NessusSuSE Local Security Checks
high
85889F5 Networks BIG-IP : Linux kernel SCTP vulnerability (K17242)NessusF5 Networks Local Security Checks
critical
85764SUSE SLES11 Security Update : kernel (SUSE-SU-2015:1478-1)NessusSuSE Local Security Checks
medium
85188OracleVM 3.3 : kernel-uek (OVMSA-2015-0109)NessusOracleVM Local Security Checks
critical
85177Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3064)NessusOracle Linux Local Security Checks
medium
84545SUSE SLED11 / SLES11 Security Update : kernel (SUSE-SU-2015:1174-1)NessusSuSE Local Security Checks
medium
84076RHEL 6 : kernel (RHSA-2015:1082)NessusRed Hat Local Security Checks
critical
83843RHEL 6 : kernel (RHSA-2015:1030)NessusRed Hat Local Security Checks
critical
83449Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3036)NessusOracle Linux Local Security Checks
critical
82999CentOS 6 : kernel (CESA-2015:0864)NessusCentOS Local Security Checks
high
82988Scientific Linux Security Update : kernel on SL6.x i386/x86_64 (20150421)NessusScientific Linux Local Security Checks
high
82985RHEL 6 : kernel (RHSA-2015:0864)NessusRed Hat Local Security Checks
high
82981Oracle Linux 6 : kernel (ELSA-2015-0864)NessusOracle Linux Local Security Checks
high
82756openSUSE Security Update : Linux Kernel (openSUSE-2015-302)NessusSuSE Local Security Checks
critical
82691OracleVM 3.3 : kernel-uek (OVMSA-2015-0040)NessusOracleVM Local Security Checks
high
82662Ubuntu 14.04 LTS : linux vulnerabilities (USN-2563-1)NessusUbuntu Local Security Checks
critical
82661Ubuntu 12.04 LTS : linux-lts-trusty vulnerabilities (USN-2562-1)NessusUbuntu Local Security Checks
critical
82636RHEL 6 : kernel (RHSA-2015:0782)NessusRed Hat Local Security Checks
medium
82518Oracle Linux 6 / 7 : Unbreakable Enterprise kernel (ELSA-2015-3019)NessusOracle Linux Local Security Checks
critical
82493RHEL 7 : kernel-rt (RHSA-2015:0727)NessusRed Hat Local Security Checks
critical
82491Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3021)NessusOracle Linux Local Security Checks
critical
82490Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3020)NessusOracle Linux Local Security Checks
critical
82474CentOS 7 : kernel (CESA-2015:0726)NessusCentOS Local Security Checks
critical
82467RHEL 6 : MRG (RHSA-2015:0751)NessusRed Hat Local Security Checks
critical
82290RHEL 7 : kernel (RHSA-2015:0726)NessusRed Hat Local Security Checks
critical
82287Oracle Linux 7 : kernel (ELSA-2015-0726)NessusOracle Linux Local Security Checks
critical
82138Debian DLA-155-1 : linux-2.6 security updateNessusDebian Local Security Checks
critical
82073Ubuntu 14.10 : linux vulnerabilities (USN-2546-1)NessusUbuntu Local Security Checks
critical
82072Ubuntu 14.04 LTS : linux-lts-utopic vulnerabilities (USN-2545-1)NessusUbuntu Local Security Checks
critical
82069Ubuntu 12.04 LTS : linux vulnerabilities (USN-2541-1)NessusUbuntu Local Security Checks
critical
81863Fedora 20 : kernel-3.18.9-100.fc20 (2015-3594)NessusFedora Local Security Checks
critical
81717Fedora 21 : kernel-3.18.8-201.fc21 (2015-3011)NessusFedora Local Security Checks
critical
81449Debian DSA-3170-1 : linux - security updateNessusDebian Local Security Checks
critical