CVE-2015-5283

Exploit

EPSS 0.55%
Veröffentlicht 19.10.2015 10:59:03
Zuletzt bearbeitet 06.05.2026 22:30:45
Quelle secalert@redhat.com
CVE-Watchlists
Login
Unerledigt
Login

The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.

Betroffene Produkte Warnungen 0 Metriken 2 CWE 1 Referenzen 19

NVD 1 VulnDex Vulnerability Enrichment 5

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Linux ≫ Linux Kernel Version <= 4.2.2

VulnDex Vulnerability Enrichment

Diese Information steht angemeldeten Benutzern zur Verfügung.

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	0.55%	0.415

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
nvd@nist.gov	4.7	3.4	6.9	AV:L/AC:M/Au:N/C:N/I:N/A:C

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

The product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary. This may result in read or write operations on unexpected memory locations that could be linked to other variables, data structures, or internal program data.

http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html

http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4

Exploit

http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html

http://patchwork.ozlabs.org/patch/515996/

Exploit

http://www.debian.org/security/2015/dsa-3372

http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.3

http://www.securityfocus.com/bid/77058

http://www.securitytracker.com/id/1033808

http://www.ubuntu.com/usn/USN-2823-1

http://www.ubuntu.com/usn/USN-2826-1

http://www.ubuntu.com/usn/USN-2829-1

http://www.ubuntu.com/usn/USN-2829-2

https://bugzilla.redhat.com/show_bug.cgi?id=1257528

https://github.com/torvalds/linux/commit/8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4

Exploit

https://security-tracker.debian.org/tracker/CVE-2015-5283

https://nvd.nist.gov/vuln/detail/CVE-2015-5283

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2015-5283

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2015-5283

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2015-5283