3.3
CVE-2015-2877
- EPSS 0.94%
- Veröffentlicht 03.03.2017 11:59:00
- Zuletzt bearbeitet 13.05.2026 00:24:29
- Erkennungen
Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities
Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version >= 2.6.32 <= 4.20.15
Redhat ≫ Enterprise Linux Version 4.0
Redhat ≫ Enterprise Linux Version 5.0
Redhat ≫ Enterprise Linux Version 6.0
Redhat ≫ Enterprise Linux Version 7.0
VulnDex Vulnerability Enrichment
Diese Information steht angemeldeten Benutzern zur Verfügung. 
Login
Login| Typ | Quelle | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.94% | 0.563 |
| Quelle | Base Score | Exploit Score | Impact Score | Vector String |
|---|---|---|---|---|
| NIST | 3.3 | 1.8 | 1.4 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N
|
| NIST | 2.1 | 3.9 | 2.9 |
AV:L/AC:L/Au:N/C:P/I:N/A:N
|
CWE-200 Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.
http://www.antoniobarresi.com/files/cain_advisory.txt
http://www.kb.cert.org/vuls/id/935424
http://www.securityfocus.com/bid/76256
https://bugzilla.redhat.com/show_bug.cgi?id=1252096
https://www.kb.cert.org/vuls/id/BGAR-A2CNKG
https://www.kb.cert.org/vuls/id/BLUU-9ZAHZH
https://www.usenix.org/system/files/conference/woot15/woot15-paper-barresi.pdf