{"id":"CVE-2015-3332","aliases":["DEBIAN-CVE-2015-3332","EUVD-2015-3378","GHSA-69wh-3xqf-4r4m","MGASA-2015-0171","MGASA-2015-0172","MGASA-2015-0219","SUSE-SU-2015:1071-1","UBUNTU-CVE-2015-3332","USN-2615-1","USN-2620-1"],"status":"published","title":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not...","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","severity":{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.00378,"percentile":0.32083,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-04-21T00:00:00Z","modified":"2026-09-30T18:20:55Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.16.7-ckt9-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.16.7-ckt9-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.16.7-ckt9-3"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-53.89"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-38.52~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt9-3"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.39-1.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.39-1.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.26-6.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.26-6.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-16.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-51.mga4.nonfree"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.010.1006-21.mga4.nonfree"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-36.mga4.nonfree"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-6.mga4.nonfree"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331.113-6.mga4.nonfree"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.39-1.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.41-1.mga4"}]}],"bundled":11},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Live Patching 12","package":"kgraft-patch-SLE12_Update_5","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.3"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-docs","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"kernel-obs-build","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.2"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.43-52.6.1"}]}],"bundled":13},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-53.89"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-38.52~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-38.52~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1","3.16.0-31.41~14.04.1","3.16.0-31.43~14.04.1","3.16.0-33.44~14.04.1","3.16.0-34.45~14.04.1","3.16.0-34.47~14.04.1","3.16.0-36.48~14.04.1","3.16.0-37.49~14.04.1","3.16.0-37.51~14.04.1"],"bundled":3},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-53.89"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74","3.13.0-46.75","3.13.0-46.76","3.13.0-46.77","3.13.0-46.79","3.13.0-48.80","3.13.0-49.81","3.13.0-49.83","3.13.0-51.84","3.13.0-52.85","3.13.0-52.86","3.13.0-53.88"]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.openwall.com/lists/oss-security/2015/04/14/14","tags":["mailing-list","x_refsource_MLIST","x_transferred","web","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1213951","tags":["x_refsource_CONFIRM","x_transferred","report"]},{"url":"http://www.debian.org/security/2015/dsa-3237","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory"]},{"url":"https://bugs.debian.org/782515","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://article.gmane.org/gmane.linux.network/359588","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-3332"},{"url":"https://github.com/advisories/GHSA-69wh-3xqf-4r4m"},{"url":"https://security-tracker.debian.org/tracker/CVE-2015-3332","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0171.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15612","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.33","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.34","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.35","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.36","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.37","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.38","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.39","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0172.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15613","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0219.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15614","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.40","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.41","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20151071-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/899192","tags":["report"]},{"url":"https://bugzilla.suse.com/900881","tags":["report"]},{"url":"https://bugzilla.suse.com/909312","tags":["report"]},{"url":"https://bugzilla.suse.com/913232","tags":["report"]},{"url":"https://bugzilla.suse.com/914742","tags":["report"]},{"url":"https://bugzilla.suse.com/915540","tags":["report"]},{"url":"https://bugzilla.suse.com/916225","tags":["report"]},{"url":"https://bugzilla.suse.com/917125","tags":["report"]},{"url":"https://bugzilla.suse.com/919007","tags":["report"]},{"url":"https://bugzilla.suse.com/919018","tags":["report"]},{"url":"https://bugzilla.suse.com/920262","tags":["report"]},{"url":"https://bugzilla.suse.com/921769","tags":["report"]},{"url":"https://bugzilla.suse.com/922583","tags":["report"]},{"url":"https://bugzilla.suse.com/922734","tags":["report"]},{"url":"https://bugzilla.suse.com/922944","tags":["report"]},{"url":"https://bugzilla.suse.com/924664","tags":["report"]},{"url":"https://bugzilla.suse.com/924803","tags":["report"]},{"url":"https://bugzilla.suse.com/924809","tags":["report"]},{"url":"https://bugzilla.suse.com/925567","tags":["report"]},{"url":"https://bugzilla.suse.com/926156","tags":["report"]},{"url":"https://bugzilla.suse.com/926240","tags":["report"]},{"url":"https://bugzilla.suse.com/926314","tags":["report"]},{"url":"https://bugzilla.suse.com/927084","tags":["report"]},{"url":"https://bugzilla.suse.com/927115","tags":["report"]},{"url":"https://bugzilla.suse.com/927116","tags":["report"]},{"url":"https://bugzilla.suse.com/927257","tags":["report"]},{"url":"https://bugzilla.suse.com/927285","tags":["report"]},{"url":"https://bugzilla.suse.com/927308","tags":["report"]},{"url":"https://bugzilla.suse.com/927455","tags":["report"]},{"url":"https://bugzilla.suse.com/928122","tags":["report"]},{"url":"https://bugzilla.suse.com/928130","tags":["report"]},{"url":"https://bugzilla.suse.com/928135","tags":["report"]},{"url":"https://bugzilla.suse.com/928141","tags":["report"]},{"url":"https://bugzilla.suse.com/928708","tags":["report"]},{"url":"https://bugzilla.suse.com/929092","tags":["report"]},{"url":"https://bugzilla.suse.com/929145","tags":["report"]},{"url":"https://bugzilla.suse.com/929525","tags":["report"]},{"url":"https://bugzilla.suse.com/929883","tags":["report"]},{"url":"https://bugzilla.suse.com/930224","tags":["report"]},{"url":"https://bugzilla.suse.com/930226","tags":["report"]},{"url":"https://bugzilla.suse.com/930669","tags":["report"]},{"url":"https://bugzilla.suse.com/930786","tags":["report"]},{"url":"https://bugzilla.suse.com/931014","tags":["report"]},{"url":"https://bugzilla.suse.com/931130","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-3647","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8086","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8159","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1465","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2041","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2666","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2830","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-2922","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3331","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3339","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-3636","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2015-3332","tags":["report"]},{"url":"http://thread.gmane.org/gmane.linux.network/359588","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2615-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2616-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2619-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2620-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-3332","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9710","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-3331","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2015-3332","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-05-27T10:00:00Z","modified":"2024-08-06T05:47:57.725Z","updated_at":"2026-11-02T14:35:42.331636Z"}],"euvd":[{"id":"EUVD-2015-3378","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-05-27T10:00:00Z","modified":"2024-08-06T05:47:57Z","updated_at":"2026-11-03T02:22:08.106657Z"}],"ghsa":[{"id":"GHSA-69wh-3xqf-4r4m","title":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not...","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2022-05-17T03:57:20Z","modified":"2023-01-28T05:00:48Z","updated_at":"2026-11-02T14:43:24.927661Z"}],"nvd":[{"id":"CVE-2015-3332","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-05-27T10:59:08.86Z","modified":"2026-06-17T00:25:45.25Z","cvss":[{"version":"2.0","score":4.9,"vector":"AV:L/AC:L/Au:N/C:N/I:N/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:03:04.906059Z"}],"osv":[{"id":"CVE-2015-3332","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-05-27T10:59:08Z","modified":"2026-04-16T06:19:03.999974443Z","updated_at":"2026-11-02T15:44:00.594921Z"},{"id":"DEBIAN-CVE-2015-3332","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-05-27T10:59:08.86Z","modified":"2026-09-09T06:47:23.764577158Z","updated_at":"2026-11-02T15:45:26.752992Z"},{"id":"MGASA-2015-0171","title":"Updated kernel package fixes security vulnerabilities","description":"This kernel update is based on upstream -longterm 3.14.39 and fixes the\nfollowing security issues:\n\nIt was found that the Linux kernel's Infiniband subsystem did not properly\nsanitize input parameters while registering memory regions from user space\nvia the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX\ndevice could use this flaw to crash the system or, potentially, escalate\ntheir privileges on the system (CVE-2014-8159)\n\nThe stack randomization feature in the Linux kernel before 3.19.1 on 64-bit\nplatforms uses incorrect data types for the results of bitwise left-shift\noperations, which makes it easier for attackers to bypass the ASLR\nprotection mechanism by predicting the address of the top of the stack,\nrelated to the randomize_stack_top function in fs/binfmt_elf.c and the\nstack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)\n\nXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly\nrestrict access to PCI command registers, which might allow local guest\nusers to cause a denial of service (non-maskable interrupt and host crash)\nby disabling the (1) memory or (2) I/O decoding for a PCI Express device\nand then accessing the device, which triggers an Unsupported Request\n(UR) response (CVE-2015-2150)\n\nSasha Levin discovered that the LLC subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this possibly allows\nprivilege escalation from a process with CAP_NET_ADMIN capability; it\nalso results in a trivial information leak (CVE-2015-2041).\n\nSasha Levin discovered that the RDS subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this results in a\ntrivial information leak (CVE-2015-2042).\n\nAndrew Lutomirski discovered that when a 64-bit task on an amd64 kernel\nmakes a fork(2) or clone(2) system call using int $0x80, the 32-bit\ncompatibility flag is set (correctly) but is not cleared on return.\nAs a result, both seccomp and audit will misinterpret the following\nsystem call by the task(s), possibly leading to a violation of security\npolicy (CVE-2015-2830).\n\nStephan Mueller discovered that the optimised implementation of RFC4106\nGCM for x86 processors that support AESNI miscalculated buffer addresses\nin some cases.  If an IPsec tunnel is configured to use this mode (also\nknown as AES-GCM-ESP) this can lead to memory corruption and crashes\n(even without malicious traffic).  This could potentially also result\nin remote code execution (CVE-2015-3331).\n\nBen Hutchings discovered that the TCP Fast Open feature regressed in\nLinux 3.16.7-ckt9, resulting in a kernel BUG when it is used.\nThis can be used as a local denial of service (CVE-2015-3332)\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-04-30T21:57:25Z","modified":"2026-04-16T06:22:55.241782077Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0172","title":"Updated kernel-linus package fixes security vulnerabilities","description":"This kernel-linus update is based on upstream -longterm 3.14.39 and fixes\nthe following security issues:\n\nIt was found that the Linux kernel's Infiniband subsystem did not properly\nsanitize input parameters while registering memory regions from user space\nvia the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX\ndevice could use this flaw to crash the system or, potentially, escalate\ntheir privileges on the system (CVE-2014-8159)\n\nThe stack randomization feature in the Linux kernel before 3.19.1 on 64-bit\nplatforms uses incorrect data types for the results of bitwise left-shift\noperations, which makes it easier for attackers to bypass the ASLR\nprotection mechanism by predicting the address of the top of the stack,\nrelated to the randomize_stack_top function in fs/binfmt_elf.c and the\nstack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)\n\nXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly\nrestrict access to PCI command registers, which might allow local guest\nusers to cause a denial of service (non-maskable interrupt and host crash)\nby disabling the (1) memory or (2) I/O decoding for a PCI Express device\nand then accessing the device, which triggers an Unsupported Request\n(UR) response (CVE-2015-2150)\n\nSasha Levin discovered that the LLC subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this possibly allows\nprivilege escalation from a process with CAP_NET_ADMIN capability; it\nalso results in a trivial information leak (CVE-2015-2041).\n\nSasha Levin discovered that the RDS subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this results in a\ntrivial information leak (CVE-2015-2042).\n\nAndrew Lutomirski discovered that when a 64-bit task on an amd64 kernel\nmakes a fork(2) or clone(2) system call using int $0x80, the 32-bit\ncompatibility flag is set (correctly) but is not cleared on return.\nAs a result, both seccomp and audit will misinterpret the following\nsystem call by the task(s), possibly leading to a violation of security\npolicy (CVE-2015-2830).\n\nStephan Mueller discovered that the optimised implementation of RFC4106\nGCM for x86 processors that support AESNI miscalculated buffer addresses\nin some cases.  If an IPsec tunnel is configured to use this mode (also\nknown as AES-GCM-ESP) this can lead to memory corruption and crashes\n(even without malicious traffic).  This could potentially also result\nin remote code execution (CVE-2015-3331).\n\nBen Hutchings discovered that the TCP Fast Open feature regressed in\nLinux 3.16.7-ckt9, resulting in a kernel BUG when it is used.\nThis can be used as a local denial of service (CVE-2015-3332)\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-04-30T21:57:25Z","modified":"2026-04-16T06:24:12.981170402Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0219","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This kernel-tmb update is based on upstream -longterm 3.14.41 and fixes\nthe following security issues:\n\nIt was found that the Linux kernel's Infiniband subsystem did not properly\nsanitize input parameters while registering memory regions from user space\nvia the (u)verbs API. A local user with access to a /dev/infiniband/uverbsX\ndevice could use this flaw to crash the system or, potentially, escalate\ntheir privileges on the system (CVE-2014-8159)\n\nnet/netfilter/nf_conntrack_proto_generic.c in the Linux kernel before\n3.18 generates incorrect conntrack entries during handling of certain\niptables rule sets for the SCTP, DCCP, GRE, and UDP-Lite protocols,\nwhich allows remote attackers to bypass intended access restrictions\nvia packets with disallowed port numbers (CVE-2014-8160).\n\nThe em_sysenter function in arch/x86/kvm/emulate.c in the Linux kernel\nbefore 3.18.5, when the guest OS lacks SYSENTER MSR initialization,\nallows guest OS users to gain guest OS privileges or cause a denial of\nservice (guest OS crash) by triggering use of a 16-bit code segment for\nemulation of a SYSENTER instruction (CVE-2015-0239).\n\nThe stack randomization feature in the Linux kernel before 3.19.1 on 64-bit\nplatforms uses incorrect data types for the results of bitwise left-shift\noperations, which makes it easier for attackers to bypass the ASLR\nprotection mechanism by predicting the address of the top of the stack,\nrelated to the randomize_stack_top function in fs/binfmt_elf.c and the\nstack_maxrandom_size function in arch/x86/mm/mmap.c (CVE-2015-1593)\n\nXen 3.3.x through 4.5.x and the Linux kernel through 3.19.1 do not properly\nrestrict access to PCI command registers, which might allow local guest\nusers to cause a denial of service (non-maskable interrupt and host crash)\nby disabling the (1) memory or (2) I/O decoding for a PCI Express device\nand then accessing the device, which triggers an Unsupported Request\n(UR) response (CVE-2015-2150)\n\nSasha Levin discovered that the LLC subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this possibly allows\nprivilege escalation from a process with CAP_NET_ADMIN capability; it\nalso results in a trivial information leak (CVE-2015-2041).\n\nSasha Levin discovered that the RDS subsystem exposed some variables as\nsysctls with the wrong type.  On a 64-bit kernel, this results in a\ntrivial information leak (CVE-2015-2042).\n\nAndrew Lutomirski discovered that when a 64-bit task on an amd64 kernel\nmakes a fork(2) or clone(2) system call using int $0x80, the 32-bit\ncompatibility flag is set (correctly) but is not cleared on return.\nAs a result, both seccomp and audit will misinterpret the following\nsystem call by the task(s), possibly leading to a violation of security\npolicy (CVE-2015-2830).\n\nStephan Mueller discovered that the optimised implementation of RFC4106\nGCM for x86 processors that support AESNI miscalculated buffer addresses\nin some cases.  If an IPsec tunnel is configured to use this mode (also\nknown as AES-GCM-ESP) this can lead to memory corruption and crashes\n(even without malicious traffic).  This could potentially also result\nin remote code execution (CVE-2015-3331).\n\nBen Hutchings discovered that the TCP Fast Open feature regressed in\nLinux 3.16.7-ckt9, resulting in a kernel BUG when it is used.\nThis can be used as a local denial of service (CVE-2015-3332)\n\nIt was found that the Linux kernel's ping socket implementation didn't\nproperly handle socket unhashing during spurious disconnects which could\nlead to use-after-free flaw. On x86-64 architecture systems, a local user\nable to create ping sockets could use this flaw to crash the system. On\nnon-x86-64 architecture systems, a local user able to create ping sockets\ncould use this flaw to increase their privileges on the system.\nNote: By default ping sockets are disabled on the system \n(net.ipv4.ping_group_range = 1  0) and have to be explicitly enabled by the\nsystem administrator for specific user groups in order to exploit this issue\n(CVE-2015-3636).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-05-13T15:54:07Z","modified":"2026-04-16T06:25:52.349134742Z","updated_at":"2026-11-02T15:49:39.792687Z"},{"id":"SUSE-SU-2015:1071-1","title":"Security update for the Linux Kernel","description":"The SUSE Linux Enterprise 12 kernel was updated to version 3.12.43 to receive various security and bugfixes.\n\nFollowing security bugs were fixed:\n\n- CVE-2014-3647: arch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through 3.17.2 did not properly perform RIP changes, which allowed guest OS users to cause a denial of service (guest OS crash) via a crafted application (bsc#899192).\n- CVE-2014-8086: Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allowed local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag (bsc#900881).\n- CVE-2014-8159: The InfiniBand (IB) implementation did not properly restrict use of User Verbs for registration of memory regions, which allowed local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/ (bsc#914742).\n- CVE-2015-1465: The IPv4 implementation in the Linux kernel before 3.18.8 did not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allowed remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets (bsc#916225).\n- CVE-2015-2041: net/llc/sysctl_net_llc.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919007).\n- CVE-2015-2042: net/rds/sysctl.c in the Linux kernel before 3.19 used an incorrect data type in a sysctl table, which allowed local users to obtain potentially sensitive information from kernel memory or possibly have unspecified other impact by accessing a sysctl entry (bsc#919018).\n- CVE-2015-2666: Fixed a flaw that allowed crafted microcode to overflow the kernel stack (bsc#922944).\n- CVE-2015-2830: Fixed int80 fork from 64-bit tasks mishandling (bsc#926240).\n- CVE-2015-2922: Fixed possible denial of service (DoS) attack against IPv6 network stacks due to improper handling of Router Advertisements (bsc#922583).\n- CVE-2015-3331: Fixed buffer overruns in RFC4106 implementation using AESNI (bsc#927257).\n- CVE-2015-3332: Fixed TCP Fast Open local DoS (bsc#928135).\n- CVE-2015-3339: Fixed race condition flaw between the chown() and execve() system calls which could have lead to local privilege escalation (bsc#928130).\n- CVE-2015-3636: Fixed use-after-free in ping sockets which could have lead to local privilege escalation (bsc#929525).\n\nThe following non-security bugs were fixed:\n\n- /proc/stat: convert to single_open_size() (bsc#928122).\n- ACPI / sysfs: Treat the count field of counter_show() as unsigned (bsc#909312).\n- Automatically Provide/Obsolete all subpackages of old flavors (bsc#925567)\n- Btrfs: btrfs_release_extent_buffer_page did not free pages of dummy extent (bsc#930226).\n- Btrfs: fix inode eviction infinite loop after cloning into it (bsc#930224).\n- Btrfs: fix inode eviction infinite loop after extent_same ioctl (bsc#930224).\n- Btrfs: fix log tree corruption when fs mounted with -o discard (bsc#927116).\n- Btrfs: fix up bounds checking in lseek (bsc#927115).\n- Fix rtworkqueues crash. Calling __sched_setscheduler() in interrupt context is forbidden, and destroy_worker() did so in the timer interrupt with a nohz_full config. Preclude that possibility for both boot options.\n- Input: psmouse - add psmouse_matches_pnp_id helper function (bsc#929092).\n- Input: synaptics - fix middle button on Lenovo 2015 products (bsc#929092).\n- Input: synaptics - handle spurious release of trackstick buttons (bsc#929092).\n- Input: synaptics - re-route tracksticks buttons on the Lenovo 2015 series (bsc#929092).\n- Input: synaptics - remove TOPBUTTONPAD property for Lenovos 2015 (bsc#929092).\n- Input: synaptics - retrieve the extended capabilities in query $10 (bsc#929092).\n- NFS: Add attribute update barriers to nfs_setattr_update_inode() (bsc#920262).\n- NFS: restore kabi after change to nfs_setattr_update_inode (bsc#920262).\n- af_iucv: fix AF_IUCV sendmsg() errno (bsc#927308, LTC#123304).\n- audit: do not reject all AUDIT_INODE filter types (bsc#927455).\n- bnx2x: Fix kdump when iommu=on (bsc#921769).\n- cpufreq: fix a NULL pointer dereference in __cpufreq_governor() (bsc#924664).\n- dasd: Fix device having no paths after suspend/resume (bsc#927308, LTC#123896).\n- dasd: Fix inability to set a DASD device offline (bsc#927308, LTC#123905).\n- dasd: Fix unresumed device after suspend/resume (bsc#927308, LTC#123892).\n- dasd: Missing partition after online processing (bsc#917125, LTC#120565).\n- drm/radeon/cik: Add macrotile mode array query (bsc#927285).\n- drm/radeon: fix display tiling setup on SI (bsc#927285).\n- drm/radeon: set correct number of banks for CIK chips in DCE (bsc#927285).\n- iommu/amd: Correctly encode huge pages in iommu page tables (bsc#931014).\n- iommu/amd: Optimize alloc_new_range for new fetch_pte interface (bsc#931014).\n- iommu/amd: Optimize amd_iommu_iova_to_phys for new fetch_pte interface (bsc#931014).\n- iommu/amd: Optimize iommu_unmap_page for new fetch_pte interface (bsc#931014).\n- iommu/amd: Return the pte page-size in fetch_pte (bsc#931014).\n- ipc/shm.c: fix overly aggressive shmdt() when calls span multiple segments (ipc fixes).\n- ipmi: Turn off all activity on an idle ipmi interface (bsc#915540).\n- ixgbe: fix detection of SFP+ capable interfaces (bsc#922734).\n- kgr: add error code to the message in kgr_revert_replaced_funs.\n- kgr: add kgraft annotations to kthreads wait_event_freezable() API calls.\n- kgr: correct error handling of the first patching stage.\n- kgr: handle the delayed patching of the modules.\n- kgr: handle the failure of finalization stage.\n- kgr: return error in kgr_init if notifier registration fails.\n- kgr: take switching of the fops out of kgr_patch_code to new function.\n- kgr: use for_each_process_thread (bsc#929883).\n- kgr: use kgr_in_progress for all threads (bnc#929883).\n- libata: Blacklist queued TRIM on Samsung SSD 850 Pro (bsc#926156).\n- mlx4: Call dev_kfree_skby_any instead of dev_kfree_skb (bsc#928708).\n- mm, numa: really disable NUMA balancing by default on single node machines (Automatic NUMA Balancing).\n- mm: vmscan: do not throttle based on pfmemalloc reserves if node has no reclaimable pages (bsc#924803, VM Functionality).\n- net/mlx4: Cache line CQE/EQE stride fixes (bsc#927084).\n- net/mlx4_core: Cache line EQE size support (bsc#927084).\n- net/mlx4_core: Enable CQE/EQE stride support (bsc#927084).\n- net/mlx4_en: Add mlx4_en_get_cqe helper (bsc#927084).\n- perf/x86/amd/ibs: Update IBS MSRs and feature definitions.\n- powerpc/mm: Fix mmap errno when MAP_FIXED is set and mapping exceeds the allowed address space (bsc#930669).\n- powerpc/numa: Add ability to disable and debug topology updates (bsc#924809).\n- powerpc/numa: Enable CONFIG_HAVE_MEMORYLESS_NODES (bsc#924809).\n- powerpc/numa: Enable USE_PERCPU_NUMA_NODE_ID (bsc#924809).\n- powerpc/numa: check error return from proc_create (bsc#924809).\n- powerpc/numa: ensure per-cpu NUMA mappings are correct on topology update (bsc#924809).\n- powerpc/numa: use cached value of update-\u0026gt;cpu in update_cpu_topology (bsc#924809).\n- powerpc/perf: Cap 64bit userspace backtraces to PERF_MAX_STACK_DEPTH (bsc#928141).\n- powerpc/pseries: Introduce api_version to migration sysfs interface (bsc#926314).\n- powerpc/pseries: Little endian fixes for post mobility device tree update (bsc#926314).\n- powerpc/pseries: Simplify check for suspendability during suspend/migration (bsc#926314).\n- powerpc: Fix sys_call_table declaration to enable syscall tracing.\n- powerpc: Fix warning reported by verify_cpu_node_mapping() (bsc#924809).\n- powerpc: Only set numa node information for present cpus at boottime (bsc#924809).\n- powerpc: reorder per-cpu NUMA information initialization (bsc#924809).\n- powerpc: some changes in numa_setup_cpu() (bsc#924809).\n- quota: Fix use of units in quota getting / setting interfaces (bsc#913232).\n- rpm/kernel-binary.spec.in: Fix build if there is no *.crt file\n- rpm/kernel-obs-qa.spec.in: Do not fail if the kernel versions do not match\n- s390/bpf: Fix ALU_NEG (A = -A) (bsc#917125, LTC#121759).\n- s390/bpf: Fix JMP_JGE_K (A \u003e= K) and JMP_JGT_K (A \u003e K) (bsc#917125, LTC#121759).\n- s390/bpf: Fix JMP_JGE_X (A \u003e X) and JMP_JGT_X (A \u003e= X) (bsc#917125, LTC#121759).\n- s390/bpf: Fix offset parameter for skb_copy_bits() (bsc#917125, LTC#121759).\n- s390/bpf: Fix sk_load_byte_msh() (bsc#917125, LTC#121759).\n- s390/bpf: Fix skb_copy_bits() parameter passing (bsc#917125, LTC#121759).\n- s390/bpf: Zero extend parameters before calling C function (bsc#917125, LTC#121759).\n- s390/sclp: Consolidate early sclp init calls to sclp_early_detect() (bsc#917125, LTC#122429).\n- s390/sclp: Determine HSA size dynamically for zfcpdump (bsc#917125, LTC#122429).\n- s390/sclp: Move declarations for sclp_sdias into separate header file (bsc#917125, LTC#122429).\n- s390/sclp: Move early code from sclp_cmd.c to sclp_early.c (bsc#917125, LTC#122429).\n- s390/sclp: replace uninitialized early_event_mask_sccb variable with sccb_early (bsc#917125, LTC#122429).\n- s390/sclp: revert smp-detect-possible-cpus.patch (bsc#917125, LTC#122429).\n- s390/sclp_early: Add function to detect sclp console capabilities (bsc#917125, LTC#122429).\n- s390/sclp_early: Get rid of sclp_early_read_info_sccb_valid (bsc#917125, LTC#122429).\n- s390/sclp_early: Pass sccb pointer to every *_detect() function (bsc#917125, LTC#122429).\n- s390/sclp_early: Replace early_read_info_sccb with sccb_early (bsc#917125, LTC#122429).\n- s390/sclp_early: Return correct HSA block count also for zero (bsc#917125, LTC#122429).\n- s390/smp: limit number of cpus in possible cpu mask (bsc#917125, LTC#122429).\n- s390: kgr, change the kgraft state only if enabled.\n- sched, time: Fix lock inversion in thread_group_cputime()\n- sched: Fix potential near-infinite distribute_cfs_runtime() loop (bsc#930786)\n- sched: Robustify topology setup (bsc#924809).\n- seqlock: Add irqsave variant of read_seqbegin_or_lock() (Time scalability).\n- storvsc: Set the SRB flags correctly when no data transfer is needed (bsc#931130).\n- x86/apic/uv: Update the APIC UV OEM check (bsc#929145).\n- x86/apic/uv: Update the UV APIC HUB check (bsc#929145).\n- x86/apic/uv: Update the UV APIC driver check (bsc#929145).\n- x86/microcode/intel: Guard against stack overflow in the loader (bsc#922944).\n","status":"published","published":"2015-06-11T16:05:11Z","modified":"2026-02-04T03:49:21.444179Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"UBUNTU-CVE-2015-3332","description":"A certain backport in the TCP Fast Open implementation for the Linux kernel before 3.18 does not properly maintain a count value, which allow local users to cause a denial of service (system crash) via the Fast Open feature, as demonstrated by visiting the chrome://flags/#enable-tcp-fast-open URL when using certain 3.10.x through 3.16.x kernel builds, including longterm-maintenance releases and ckt (aka Canonical Kernel Team) builds.","status":"published","published":"2015-04-21T00:00:00Z","modified":"2026-09-30T18:20:55.138564877Z","updated_at":"2026-11-02T15:54:10.045446Z"},{"id":"USN-2615-1","title":"linux-lts-utopic vulnerabilities","description":"Alexandre Oliva reported a race condition flaw in the btrfs file system's\nhandling of extended attributes (xattrs). A local attacker could exploit\nthis flaw to bypass ACLs and potentially escalate privileges.\n(CVE-2014-9710)\n\nA memory corruption issue was discovered in AES decryption when using the\nIntel AES-NI accelerated code path. A remote attacker could exploit this\nflaw to cause a denial of service (system crash) or potentially escalate\nprivileges on Intel base machines with AEC-GCM mode IPSec security\nassociation. (CVE-2015-3331)\n\nA flaw was discovered in the Linux kernel's IPv4 networking when using TCP\nfast open to initiate a connection. An unprivileged local user could\nexploit this flaw to cause a denial of service (system crash).\n(CVE-2015-3332)\n","status":"published","published":"2015-05-20T11:31:28Z","modified":"2026-02-10T04:40:54Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2620-1","title":"linux vulnerability","description":"A flaw was discovered in the Linux kernel's IPv4 networking when using TCP\nfast open to initiate a connection. An unprivileged local user could\nexploit this flaw to cause a denial of service (system crash).\n","status":"published","published":"2015-05-23T07:06:36Z","modified":"2026-04-22T09:12:56.093437Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}