9.3
CVE-2015-8962
- EPSS 0.34%
- Published 16.11.2016 05:59:01
- Last modified 12.04.2025 10:46:40
- Source security@android.com
- Teams watchlist Login
- Open Login
Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.
Data is provided by the National Vulnerability Database (NVD)
Linux ≫ Linux Kernel Version < 3.2.85
Linux ≫ Linux Kernel Version >= 3.3 < 3.10.107
Linux ≫ Linux Kernel Version >= 3.12 < 3.12.70
Linux ≫ Linux Kernel Version >= 3.13 < 3.16.40
Linux ≫ Linux Kernel Version >= 3.17 < 3.18.54
Linux ≫ Linux Kernel Version >= 3.19 < 4.4
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
| Type | Source | Score | Percentile |
|---|---|---|---|
| EPSS | FIRST.org | 0.34% | 0.561 |
| Source | Base Score | Exploit Score | Impact Score | Vector string |
|---|---|---|---|---|
| nvd@nist.gov | 7.3 | 1.3 | 5.9 |
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
|
| nvd@nist.gov | 9.3 | 8.6 | 10 |
AV:N/AC:M/Au:N/C:C/I:C/A:C
|
CWE-415 Double Free
The product calls free() twice on the same memory address, potentially leading to modification of unexpected memory locations.