CVE-2015-8839medium
New! CVE Severity Now Using CVSS v3
The calculated severity for CVEs has been updated to use CVSS v3 by default. CVEs that do not have a CVSS v3 score will fall back CVSS v2 for calculating severity. Severity display preferences can be toggled in the settings dropdown.
Description
Multiple race conditions in the ext4 filesystem implementation in the Linux kernel before 4.5 allow local users to cause a denial of service (disk corruption) by writing to a page that is associated with a different user's file after unsynchronized hole punching and page-fault handling.
References
http://www.openwall.com/lists/oss-security/2016/04/01/4
http://www.securityfocus.com/bid/85798
http://www.securitytracker.com/id/1035455
http://www.ubuntu.com/usn/USN-3005-1
http://www.ubuntu.com/usn/USN-3006-1
http://www.ubuntu.com/usn/USN-3007-1
https://access.redhat.com/errata/RHSA-2017:1842
https://access.redhat.com/errata/RHSA-2017:2077
https://access.redhat.com/errata/RHSA-2017:2669
https://bugzilla.redhat.com/show_bug.cgi?id=1323577
https://github.com/torvalds/linux/commit/ea3d7209ca01da209cda6f0dea8be9cc4b7a933b
https://lists.debian.org/debian-lts-announce/2020/06/msg00011.html
https://lists.debian.org/debian-lts-announce/2020/06/msg00013.html
Details
Source: MITRE
Published: 2016-05-02
Updated: 2020-10-02
Type: CWE-362
Risk Information
CVSS v2
Base Score: 1.9
Vector: AV:L/AC:M/Au:N/C:N/I:N/A:P
Impact Score: 2.9
Exploitability Score: 3.4
Severity: LOW
CVSS v3
Base Score: 5.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H
Impact Score: 3.6
Exploitability Score: 1.4
Severity: MEDIUM
Vulnerable Software
Configuration 1
OR
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* versions up to 4.4.221 (inclusive)
cpe:2.3:o:linux:linux_kernel:4.5:rc1:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.5:rc2:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.5:rc3:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.5:rc4:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:4.5:rc5:*:*:*:*:*:*
Configuration 2
OR
Tenable Plugins
| ID | Name | Product | Family | Severity |
|---|---|---|---|---|
| 137283 | Debian DLA-2241-2 : linux security update | Nessus | Debian Local Security Checks | medium |
| 124835 | EulerOS Virtualization 3.0.1.0 : kernel (EulerOS-SA-2019-1514) | Nessus | Huawei Local Security Checks | medium |
| 103046 | RHEL 6 : MRG (RHSA-2017:2669) | Nessus | Red Hat Local Security Checks | high |
| 102734 | CentOS 7 : kernel (CESA-2017:1842) (Stack Clash) | Nessus | CentOS Local Security Checks | high |
| 102645 | Scientific Linux Security Update : kernel on SL7.x x86_64 (20170801) | Nessus | Scientific Linux Local Security Checks | high |
| 102281 | Oracle Linux 7 : kernel (ELSA-2017-1842) | Nessus | Oracle Linux Local Security Checks | high |
| 102242 | EulerOS 2.0 SP2 : kernel (EulerOS-SA-2017-1155) | Nessus | Huawei Local Security Checks | high |
| 102241 | EulerOS 2.0 SP1 : kernel (EulerOS-SA-2017-1154) | Nessus | Huawei Local Security Checks | high |
| 102151 | RHEL 7 : kernel-rt (RHSA-2017:2077) | Nessus | Red Hat Local Security Checks | high |
| 102143 | RHEL 7 : kernel (RHSA-2017:1842) (Stack Clash) | Nessus | Red Hat Local Security Checks | high |
| 91569 | Ubuntu 16.04 LTS : linux-raspi2 vulnerabilities (USN-3007-1) | Nessus | Ubuntu Local Security Checks | high |
| 91568 | Ubuntu 16.04 LTS : linux vulnerabilities (USN-3006-1) | Nessus | Ubuntu Local Security Checks | high |
| 91567 | Ubuntu 14.04 LTS : linux-lts-xenial vulnerabilities (USN-3005-1) | Nessus | Ubuntu Local Security Checks | high |
| 91241 | Amazon Linux AMI : kernel (ALAS-2016-703) | Nessus | Amazon Linux Local Security Checks | high |
| 90952 | Fedora 22 : kernel-4.4.8-200.fc22 (2016-373c063e79) | Nessus | Fedora Local Security Checks | critical |
| 90656 | Fedora 23 : kernel-4.4.7-300.fc23 (2016-8e858f96b8) | Nessus | Fedora Local Security Checks | high |