{"id":"CVE-2015-1465","aliases":["BELL-CVE-2015-1465","DEBIAN-CVE-2015-1465","EUVD-2015-1600","GHSA-wf34-7h5v-335r","MGASA-2015-0070","MGASA-2015-0076","MGASA-2015-0077","MGASA-2015-0078","SUSE-SU-2015:1071-1","SUSE-SU-2015:1488-1","SUSE-SU-2015:1489-1","UBUNTU-CVE-2015-1465","USN-2545-1","USN-2563-1"],"status":"published","title":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length...","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.06466,"percentile":0.93785,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-17"],"published":"2015-02-05T00:00:00Z","modified":"2026-09-09T06:47:19Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.16.7-ckt7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.16.7-ckt7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.16.7-ckt7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-49.81"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-33.44~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt7-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.20-5.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.20-5.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-11.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-47.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.010.1006-17.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-31.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-3.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331.113-3.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-0.rt28.1.mga4"}]}],"bundled":29},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-0.vs2.3.6.14.1.mga4"}]}],"bundled":21},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.1"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3-2.1"}]}],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-49.81"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-33.44~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-33.44~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1"],"bundled":4},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-49.81"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80"],"bundled":5}],"products":[{"vendor":"canonical","product":"ubuntu_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.ubuntu.com/usn/USN-2562-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.ubuntu.com/usn/USN-2546-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2563-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.securitytracker.com/id/1036763","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/03/13","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1183744","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.ubuntu.com/usn/USN-2545-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/torvalds/linux/commit/df4d92549f23e1c037e83323aff58a21b3de7fe0","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=df4d92549f23e1c037e83323aff58a21b3de7fe0","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securityfocus.com/bid/72435","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.8","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-1465"},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=df4d92549f23e1c037e83323aff58a21b3de7fe0"},{"url":"https://github.com/advisories/GHSA-wf34-7h5v-335r"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2015-1465","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-1465","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15221","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.28","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.29","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.30","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.31","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.32","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0076.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15223","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.24","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.25","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.26","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.27","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15224","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_3.13","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_3.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.13","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.15","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.16","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.17","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.18","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.19","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.20","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.21","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.22","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.23","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15225","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151071-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/899192","tags":["report"]},{"url":"https://bugzilla.suse.com/900881","tags":["report"]},{"url":"https://bugzilla.suse.com/909312","tags":["report"]},{"url":"https://bugzilla.suse.com/913232","tags":["report"]},{"url":"https://bugzilla.suse.com/914742","tags":["report"]},{"url":"https://bugzilla.suse.com/915540","tags":["report"]},{"url":"https://bugzilla.suse.com/916225","tags":["report"]},{"url":"https://bugzilla.suse.com/917125","tags":["report"]},{"url":"https://bugzilla.suse.com/919007","tags":["report"]},{"url":"https://bugzilla.suse.com/919018","tags":["report"]},{"url":"https://bugzilla.suse.com/920262","tags":["report"]},{"url":"https://bugzilla.suse.com/921769","tags":["report"]},{"url":"https://bugzilla.suse.com/922583","tags":["report"]},{"url":"https://bugzilla.suse.com/922734","tags":["report"]},{"url":"https://bugzilla.suse.com/922944","tags":["report"]},{"url":"https://bugzilla.suse.com/924664","tags":["report"]},{"url":"https://bugzilla.suse.com/924803","tags":["report"]},{"url":"https://bugzilla.suse.com/924809","tags":["report"]},{"url":"https://bugzilla.suse.com/925567","tags":["report"]},{"url":"https://bugzilla.suse.com/926156","tags":["report"]},{"url":"https://bugzilla.suse.com/926240","tags":["report"]},{"url":"https://bugzilla.suse.com/926314","tags":["report"]},{"url":"https://bugzilla.suse.com/927084","tags":["report"]},{"url":"https://bugzilla.suse.com/927115","tags":["report"]},{"url":"https://bugzilla.suse.com/927116","tags":["report"]},{"url":"https://bugzilla.suse.com/927257","tags":["report"]},{"url":"https://bugzilla.suse.com/927285","tags":["report"]},{"url":"https://bugzilla.suse.com/927308","tags":["report"]},{"url":"https://bugzilla.suse.com/927455","tags":["report"]},{"url":"https://bugzilla.suse.com/928122","tags":["report"]},{"url":"https://bugzilla.suse.com/928130","tags":["report"]},{"url":"https://bugzilla.suse.com/928135","tags":["report"]},{"url":"https://bugzilla.suse.com/928141","tags":["report"]},{"url":"https://bugzilla.suse.com/928708","tags":["report"]},{"url":"https://bugzilla.suse.com/929092","tags":["report"]},{"url":"https://bugzilla.suse.com/929145","tags":["report"]},{"url":"https://bugzilla.suse.com/929525","tags":["report"]},{"url":"https://bugzilla.suse.com/929883","tags":["report"]},{"url":"https://bugzilla.suse.com/930224","tags":["report"]},{"url":"https://bugzilla.suse.com/930226","tags":["report"]},{"url":"https://bugzilla.suse.com/930669","tags":["report"]},{"url":"https://bugzilla.suse.com/930786","tags":["report"]},{"url":"https://bugzilla.suse.com/931014","tags":["report"]},{"url":"https://bugzilla.suse.com/931130","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3636","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151488-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/939044","tags":["report"]},{"url":"https://bugzilla.suse.com/939240","tags":["report"]},{"url":"https://bugzilla.suse.com/939241","tags":["report"]},{"url":"https://bugzilla.suse.com/939262","tags":["report"]},{"url":"https://bugzilla.suse.com/939263","tags":["report"]},{"url":"https://bugzilla.suse.com/939270","tags":["report"]},{"url":"https://bugzilla.suse.com/939273","tags":["report"]},{"url":"https://bugzilla.suse.com/939276","tags":["report"]},{"url":"https://bugzilla.suse.com/939277","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7822","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1805","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-4700","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5364","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5366","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151489-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/902349","tags":["report"]},{"url":"https://bugzilla.suse.com/939260","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3687","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9710","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-1465","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2015/02/02/2","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2545-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2546-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2562-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2563-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-1465","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2013-7421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9644","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1421","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-1593","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-2042","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-1465","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-04-05T21:00:00Z","modified":"2024-08-06T04:47:15.938Z","updated_at":"2026-11-02T14:35:43.698357Z"}],"euvd":[{"id":"EUVD-2015-1600","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-04-05T21:00:00Z","modified":"2024-08-06T04:47:15Z","updated_at":"2026-11-03T02:22:15.605684Z"}],"ghsa":[{"id":"GHSA-wf34-7h5v-335r","title":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length...","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2022-05-17T02:15:10Z","modified":"2025-04-12T12:47:49Z","updated_at":"2026-11-02T15:01:21.867045Z"}],"nvd":[{"id":"CVE-2015-1465","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-04-05T21:59:01.233Z","modified":"2026-06-17T00:22:28.513Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-17"],"updated_at":"2026-11-02T14:03:04.095849Z"}],"osv":[{"id":"BELL-CVE-2015-1465","title":"CVE-2015-1465 does not affect BellSoft software","status":"withdrawn","published":"2015-04-05T21:59:00Z","modified":"2026-01-28T07:21:39.08706Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2015-1465","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-04-05T21:59:01Z","modified":"2026-04-16T06:20:26.810163332Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2015-1465","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-04-05T21:59:01.233Z","modified":"2026-09-09T06:47:19.70239865Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0070","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggerinf a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-17T18:38:13Z","modified":"2026-04-16T06:25:01.110931073Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0076","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This kernel-tmb update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:25:04.464521306Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0077","title":"Updated kernel-rt packages fix security vulnerabilities","description":"This kernel-rt update provides as upgrade to upstream 3.14 longterm branch,\ncurrently based on 3.14.32 and fixes the following security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when \nCONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local\nusers to obtain potentially sensitive single-bit values from kernel memory\nor cause a denial of service (OOPS) via a large value of a syscall number.\nTo avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.\n(CVE-2014-3917)\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nThe -rt patch has been updated to -rt28.\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:24:42.918265494Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0078","title":"Updated kernel-vserver packages fix security vulnerabilities","description":"This kernel-vserver update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nThe vserver patch has been updated to vs2.3.6.14\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:22:23.721995927Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"SUSE-SU-2015:1071-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes.\n\nFollowing security bugs were fixed:\n\n- CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192).\n- CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881).\n- CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742).\n- CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225).\n- CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007).\n- CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018).\n- CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944).\n- CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240).\n- CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583).\n- CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257).\n- CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135).\n- CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130).\n- CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525).\n\nThe following non-security bugs were fixed:\n\n- /proc/stat: convert to single_open_size() (bsc#928122).\n- ACPI / sysfs: Treat the count field of counter_show() as unsigned (bsc#909312).\n- Automatically Provide/Obsolete all subpackages of old flavors (bsc#925567)\n- Btrfs: btrfs_release_extent_buffer_page did not free pages of dummy extent (bsc#930226).\n- Btrfs: fix inode eviction infinite loop after cloning into it (bsc#930224).\n- Btrfs: fix inode eviction infinite loop after extent_same ioctl (bsc#930224).\n- Btrfs: fix log tree corruption when fs mounted with -o discard (bsc#927116).\n- Btrfs: fix up bounds checking in lseek (bsc#927115).\n- Fix rtworkqueues crash. Calling __sched_setscheduler() in interrupt context is forbidden, and destroy_worker() did so in the timer interrupt with a nohz_full config. Preclude that possibility for both boot options.\n- Input: psmouse - add psmouse_matches_pnp_id helper function (bsc#929092).\n- Input: synaptics - fix middle button on Lenovo 2015 products (bsc#929092).\n- Input: synaptics - handle spurious release of trackstick buttons (bsc#929092).\n- Input: synaptics - re-route tracksticks buttons on the Lenovo 2015 series (bsc#929092).\n- Input: synaptics - remove TOPBUTTONPAD property for Lenovos 2015 (bsc#929092).\n- Input: synaptics - retrieve the extended capabilities in query $10 (bsc#929092).\n- NFS: Add attribute update barriers to nfs_setattr_update_inode() (bsc#920262).\n- NFS: restore kabi after change to nfs_setattr_update_inode (bsc#920262).\n- af_iucv: fix AF_IUCV sendmsg() errno (bsc#927308, LTC#123304).\n- audit: do not reject all AUDIT_INODE filter types (bsc#927455).\n- bnx2x: Fix kdump when iommu=on (bsc#921769).\n- cpufreq: fix a NULL pointer dereference in __cpufreq_governor() (bsc#924664).\n- dasd: Fix device having no paths after suspend/resume (bsc#927308, LTC#123896).\n- dasd: Fix inability to set a DASD device offline (bsc#927308, LTC#123905).\n- dasd: Fix unresumed device after suspend/resume (bsc#927308, LTC#123892).\n- dasd: Missing partition after online processing (bsc#917125, LTC#120565).\n- drm/radeon/cik: Add macrotile mode array query (bsc#927285).\n- drm/radeon: fix display tiling setup on SI (bsc#927285).\n- drm/radeon: set correct number of banks for CIK chips in DCE (bsc#927285).\n- iommu/amd: Correctly encode huge pages in iommu page tables (bsc#931014).\n- iommu/amd: Optimize alloc_new_range for new fetch_pte interface (bsc#931014).\n- iommu/amd: Optimize amd_iommu_iova_to_phys for new fetch_pte interface (bsc#931014).\n- iommu/amd: Optimize iommu_unmap_page for new fetch_pte interface (bsc#931014).\n- iommu/amd: Return the pte page-size in fetch_pte (bsc#931014).\n- ipc/shm.c: fix overly aggressive shmdt() when calls span multiple segments (ipc fixes).\n- ipmi: Turn off all activity on an idle ipmi interface (bsc#915540).\n- ixgbe: fix detection of SFP+ capable interfaces (bsc#922734).\n- kgr: add error code to the message in kgr_revert_replaced_funs.\n- kgr: add kgraft annotations to kthreads wait_event_freezable() API calls.\n- kgr: correct error handling of the first patching stage.\n- kgr: handle the delayed patching of the modules.\n- kgr: handle the failure of finalization stage.\n- kgr: return error in kgr_init if notifier registration fails.\n- kgr: take switching of the fops out of kgr_patch_code to new function.\n- kgr: use for_each_process_thread (bsc#929883).\n- kgr: use kgr_in_progress for all threads (bnc#929883).\n- libata: Blacklist queued TRIM on Samsung SSD 850 Pro (bsc#926156).\n- mlx4: Call dev_kfree_skby_any instead of dev_kfree_skb (bsc#928708).\n- mm, numa: really disable NUMA balancing by default on single node machines (Automatic NUMA Balancing).\n- mm: vmscan: do not throttle based on pfmemalloc reserves if node has no reclaimable pages (bsc#924803, VM Functionality).\n- net/mlx4: Cache line CQE/EQE stride fixes (bsc#927084).\n- net/mlx4_core: Cache line EQE size support (bsc#927084).\n- net/mlx4_core: Enable CQE/EQE stride support (bsc#927084).\n- net/mlx4_en: Add mlx4_en_get_cqe helper (bsc#927084).\n- perf/x86/amd/ibs: Update IBS MSRs and feature definitions.\n- powerpc/mm: Fix mmap errno when MAP_FIXED is set and mapping exceeds the allowed address space (bsc#930669).\n- powerpc/numa: Add ability to disable and debug topology updates (bsc#924809).\n- powerpc/numa: Enable CONFIG_HAVE_MEMORYLESS_NODES (bsc#924809).\n- powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID (bsc#924809).\n- powerpc/numa: check error return from proc_create (bsc#924809).\n- powerpc/numa: ensure per-cpu NUMA mappings are correct on topology update (bsc#924809).\n- powerpc/numa: use cached value of update-\u0026gt;cpu in update_cpu_topology (bsc#924809).\n- powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH (bsc#928141).\n- powerpc/pseries: Introduce api_version to migration sysfs interface (bsc#926314).\n- powerpc/pseries: Little endian fixes for post mobility device tree update (bsc#926314).\n- powerpc/pseries: Simplify check for suspendability during suspend/migration (bsc#926314).\n- powerpc: Fix sys_call_table declaration to enable syscall tracing.\n- powerpc: Fix warning reported by verify_cpu_node_mapping() (bsc#924809).\n- powerpc: Only set numa node information for present cpus at boottime (bsc#924809).\n- powerpc: reorder per-cpu NUMA information initialization (bsc#924809).\n- powerpc: some changes in numa_setup_cpu() (bsc#924809).\n- quota: Fix use of units in quota getting / setting interfaces (bsc#913232).\n- rpm/kernel-binary.spec.in: Fix build if there is no *.crt file\n- rpm/kernel-obs-qa.spec.in: Do not fail if the kernel versions do not match\n- s390/bpf: Fix ALU_NEG (A = -A) (bsc#917125, LTC#121759).\n- s390/bpf: Fix JMP_JGE_K (A \u003e= K) and JMP_JGT_K (A \u003e K) (bsc#917125, LTC#121759).\n- s390/bpf: Fix JMP_JGE_X (A \u003e X) and JMP_JGT_X (A \u003e= X) (bsc#917125, LTC#121759).\n- s390/bpf: Fix offset parameter for skb_copy_bits() (bsc#917125, LTC#121759).\n- s390/bpf: Fix sk_load_byte_msh() (bsc#917125, LTC#121759).\n- s390/bpf: Fix skb_copy_bits() parameter passing (bsc#917125, LTC#121759).\n- s390/bpf: Zero extend parameters before calling C function (bsc#917125, LTC#121759).\n- s390/sclp: Consolidate early sclp init calls to sclp_early_detect() (bsc#917125, LTC#122429).\n- s390/sclp: Determine HSA size dynamically for zfcpdump (bsc#917125, LTC#122429).\n- s390/sclp: Move declarations for sclp_sdias into separate header file (bsc#917125, LTC#122429).\n- s390/sclp: Move early code from sclp_cmd.c to sclp_early.c (bsc#917125, LTC#122429).\n- s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_early (bsc#917125, LTC#122429).\n- s390/sclp: revert smp-detect-possible-cpus.patch (bsc#917125, LTC#122429).\n- s390/sclp_early: Add function to detect sclp console capabilities (bsc#917125, LTC#122429).\n- s390/sclp_early: Get rid of sclp_early_read_info_sccb_valid (bsc#917125, LTC#122429).\n- s390/sclp_early: Pass sccb pointer to every *_detect() function (bsc#917125, LTC#122429).\n- s390/sclp_early: Replace early_read_info_sccb with sccb_early (bsc#917125, LTC#122429).\n- s390/sclp_early: Return correct HSA block count also for zero (bsc#917125, LTC#122429).\n- s390/smp: limit number of cpus in possible cpu mask (bsc#917125, LTC#122429).\n- s390: kgr, change the kgraft state only if enabled.\n- sched, time: Fix lock inversion in thread_group_cputime()\n- sched: Fix potential near-infinite distribute_cfs_runtime() loop (bsc#930786)\n- sched: Robustify topology setup (bsc#924809).\n- seqlock: Add irqsave variant of read_seqbegin_or_lock() (Time scalability).\n- storvsc: Set the SRB flags correctly when no data transfer is needed (bsc#931130).\n- x86/apic/uv: Update the APIC UV OEM check (bsc#929145).\n- x86/apic/uv: Update the UV APIC HUB check (bsc#929145).\n- x86/apic/uv: Update the UV APIC driver check (bsc#929145).\n- x86/microcode/intel: Guard against stack overflow in the loader (bsc#922944).\n","status":"published","published":"2015-06-11T16:05:11Z","modified":"2026-02-04T03:49:21.444179Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:1488-1","title":"Live patch for the Linux Kernel","description":"\nThis update contains a kernel live patch for the 3.12.36-38 SUSE Linux Enterprise\nServer 12 Kernel, fixing following security issues.\n\n- CVE-2015-3339: A race condition in the prepare_binprm function in\n  fs/exec.c in the Linux kernel allowed local users to gain privileges\n  by executing a setuid program at a time instant when a chown to root\n  is in progress, and the ownership is changed but the setuid bit is not\n  yet stripped. (bsc#939263 bsc#939044)\n\n- CVE-2015-1465: The IPv4 implementation in the Linux kernel did not\n  properly consider the length of the Read-Copy Update (RCU) grace period\n  for redirecting lookups in the absence of caching, which allowed remote\n  attackers to cause a denial of service (memory consumption or system\n  crash) via a flood of packets. (bsc#939044 bsc#916225)\n\n- CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the\n  Linux kernel did not initialize a certain list data structure during an\n  unhash operation, which allowed local users to gain privileges or cause\n  a denial of service (use-after-free and system crash) by leveraging the\n  ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP\n  or IPPROTO_ICMPV6 protocol, and then making a connect system call after\n  a disconnect. (bsc#939277)\n\n- CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood\n  of UDP packets with invalid checksums were fixed that could be used\n  by remote attackers to delay execution. (bsc#939276)\n\n- CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in\n  fs/pipe.c in the Linux kernel did not properly consider the side effects\n  of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,\n  which allowed local users to cause a denial of service (system crash)\n  or possibly gain privileges via a crafted application, aka an 'I/O vector\n  array overrun.' (bsc#939270)\n\n- CVE-2015-4700: A BPF Jit optimization flaw could allow local users\n  to panic the kernel. (bsc#939273)\n\n- CVE-2015-3331: The __driver_rfc4106_decrypt function in\n  arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly\n  determine the memory locations used for encrypted data, which allowed\n  context-dependent attackers to cause a denial of service (buffer overflow\n  and system crash) or possibly execute arbitrary code by triggering a\n  crypto API call, as demonstrated by use of a libkcapi test program with\n  an AF_ALG(aead) socket. (bsc#939262)\n\n- CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel\n  did not properly restrict use of User Verbs for registration of memory\n  regions, which allowed local users to access arbitrary physical memory\n  locations, and consequently cause a denial of service (system crash)\n  or gain privileges, by leveraging permissions on a uverbs device under\n  /dev/infiniband/. (bsc#939241)\n\n- CVE-2014-7822: The implementation of certain splice_write file\n  operations in the Linux kernel before 3.16 does not enforce a restriction\n  on the maximum size of a single file, which allows local users to cause\n  a denial of service (system crash) or possibly have unspecified other\n  impact via a crafted splice system call, as demonstrated by use of a\n  file descriptor associated with an ext4 filesystem. (bsc#939240)\n","status":"published","published":"2015-08-14T09:23:31Z","modified":"2026-02-04T04:36:26.622616Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2015:1489-1","title":"Live patch for the Linux Kernel","description":"\nThis update contains a kernel live patch for the 3.12.32-33 SUSE Linux Enterprise\nServer 12 Kernel, fixing following security issues.\n\n- CVE-2015-3339: A race condition in the prepare_binprm function in\n  fs/exec.c in the Linux kernel allowed local users to gain privileges\n  by executing a setuid program at a time instant when a chown to root\n  is in progress, and the ownership is changed but the setuid bit is not\n  yet stripped. (bsc#939263 bsc#939044)\n\n- CVE-2015-1465: The IPv4 implementation in the Linux kernel did not\n  properly consider the length of the Read-Copy Update (RCU) grace period\n  for redirecting lookups in the absence of caching, which allowed remote\n  attackers to cause a denial of service (memory consumption or system\n  crash) via a flood of packets. (bsc#939044 bsc#916225)\n\n- CVE-2015-3636: The ping_unhash function in net/ipv4/ping.c in the\n  Linux kernel did not initialize a certain list data structure during an\n  unhash operation, which allowed local users to gain privileges or cause\n  a denial of service (use-after-free and system crash) by leveraging the\n  ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP\n  or IPPROTO_ICMPV6 protocol, and then making a connect system call after\n  a disconnect. (bsc#939277)\n\n- CVE-2015-5364/CVE-2015-5366: Two denial of service attacks via a flood\n  of UDP packets with invalid checksums were fixed that could be used\n  by remote attackers to delay execution. (bsc#939276)\n\n- CVE-2015-1805: The (1) pipe_read and (2) pipe_write implementations in\n  fs/pipe.c in the Linux kernel did not properly consider the side effects\n  of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls,\n  which allowed local users to cause a denial of service (system crash)\n  or possibly gain privileges via a crafted application, aka an 'I/O vector\n  array overrun.' (bsc#939270)\n\n- CVE-2015-4700: A BPF Jit optimization flaw could allow local users\n  to panic the kernel. (bsc#939273)\n\n- CVE-2014-9710: The Btrfs implementation in the Linux kernel did not\n  ensure that the visible xattr state is consistent with a requested\n  replacement, which allowed local users to bypass intended ACL settings\n  and gain privileges via standard filesystem operations (1) during an\n  xattr-replacement time window, related to a race condition, or (2) after\n  an xattr-replacement attempt that fails because the data does not fit.\n  (bsc#939260)\n\n- CVE-2014-3687: The sctp_assoc_lookup_asconf_ack function in\n  net/sctp/associola.c in the SCTP implementation in the Linux kernel\n  allowed remote attackers to cause a denial of service (panic) via\n  duplicate ASCONF chunks that trigger an incorrect uncork within the\n  side-effect interpreter. (bsc#902349 bsc#939044)\n\n- CVE-2015-3331: The __driver_rfc4106_decrypt function in\n  arch/x86/crypto/aesni-intel_glue.c in the Linux kernel did not properly\n  determine the memory locations used for encrypted data, which allowed\n  context-dependent attackers to cause a denial of service (buffer overflow\n  and system crash) or possibly execute arbitrary code by triggering a\n  crypto API call, as demonstrated by use of a libkcapi test program with\n  an AF_ALG(aead) socket. (bsc#939262)\n\n- CVE-2014-8159: The InfiniBand (IB) implementation in the Linux kernel\n  did not properly restrict use of User Verbs for registration of memory\n  regions, which allowed local users to access arbitrary physical memory\n  locations, and consequently cause a denial of service (system crash)\n  or gain privileges, by leveraging permissions on a uverbs device under\n  /dev/infiniband/. (bsc#939241)\n\n- CVE-2014-7822: The implementation of certain splice_write file\n  operations in the Linux kernel before 3.16 does not enforce a restriction\n  on the maximum size of a single file, which allows local users to cause\n  a denial of service (system crash) or possibly have unspecified other\n  impact via a crafted splice system call, as demonstrated by use of a\n  file descriptor associated with an ext4 filesystem. (bsc#939240)\n","status":"published","published":"2015-08-14T08:44:17Z","modified":"2026-02-04T03:49:53.386967Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"UBUNTU-CVE-2015-1465","description":"The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.","status":"published","published":"2015-02-05T00:00:00Z","modified":"2026-04-22T10:03:32.616203Z","updated_at":"2026-11-02T15:54:09.721803Z"},{"id":"USN-2545-1","title":"linux-lts-utopic vulnerabilities","description":"A flaw was discovered in the automatic loading of modules in the crypto\nsubsystem of the Linux kernel. A local user could exploit this flaw to load\ninstalled kernel modules, increasing the attack surface and potentially\nusing this to gain administrative privileges. (CVE-2013-7421)\n\nA flaw was discovered in the crypto subsystem when screening module names\nfor automatic module loading if the name contained a valid crypto module\nname, eg. vfat(aes). A local user could exploit this flaw to load installed\nkernel modules, increasing the attack surface and potentially using this to\ngain administrative privileges. (CVE-2014-9644)\n\nSun Baoliang discovered a use after free flaw in the Linux kernel's SCTP\n(Stream Control Transmission Protocol) subsystem during INIT collisions. A\nremote attacker could exploit this flaw to cause a denial of service\n(system crash) or potentially escalate their privileges on the system.\n(CVE-2015-1421)\n\nMarcelo Leitner discovered a flaw in the Linux kernel's routing of packets\nto too many different dsts/too fast. A remote attacker can exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-1465)\n","status":"published","published":"2015-03-24T09:25:33Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2563-1","title":"linux vulnerabilities","description":"Sun Baoliang discovered a use after free flaw in the Linux kernel's SCTP\n(Stream Control Transmission Protocol) subsystem during INIT collisions. A\nremote attacker could exploit this flaw to cause a denial of service\n(system crash) or potentially escalate their privileges on the system.\n(CVE-2015-1421)\n\nMarcelo Leitner discovered a flaw in the Linux kernel's routing of packets\nto too many different dsts/too fast. A remote attacker on the same subnet can exploit this\nflaw to cause a denial of service (system crash). (CVE-2015-1465)\n\nAn integer overflow was discovered in the stack randomization feature of\nthe Linux kernel on 64 bit platforms. A local attacker could exploit this\nflaw to bypass the Address Space Layout Randomization (ASLR) protection\nmechanism. (CVE-2015-1593)\n\nAn information leak was discovered in the Linux Kernel's handling of\nuserspace configuration of the link layer control (LLC). A local user could\nexploit this flaw to read data from other sysctl settings. (CVE-2015-2041)\n\nAn information leak was discovered in how the Linux kernel handles setting\nthe Reliable Datagram Sockets (RDS) settings. A local user could exploit\nthis flaw to read data from other sysctl settings. (CVE-2015-2042)\n","status":"published","published":"2015-04-08T22:27:31Z","modified":"2026-04-22T09:09:50.694931Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}