CVE-2015-4004
published 2015-06-07CVE-2015-4004: The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain…
PriorityP340high8.5CVSS 2.0
AVNACLAuNCPINAC
EPSS
8.15%
94.2th percentile
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 4.3-1 (bookworm) | linux 4.3-1 (bookworm) |
| linux | linux_kernel | >= 0 < 4.3-1 | 4.3-1 |
| linux | linux_kernel | >= 0 < 4.3-1 | 4.3-1 |
| linux | linux_kernel | >= 0 < 4.3-1 | 4.3-1 |
| linux | linux_kernel | >= 0 < 4.3-1 | 4.3-1 |
| linux | linux_kernel | >= 0 < 3.13.0-87.133 | 3.13.0-87.133 |
| linux | linux_kernel | >= 3.4 < 4.3 | 4.3 |
CVSS provenance
nvdv2.08.5HIGHAV:N/AC:L/Au:N/C:P/I:N/A:C
osv8.5HIGH
vendor_debian8.5LOW
vendor_redhat8.5HIGH
vendor_ubuntu8.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux
Ubuntu
Linux kernel (Wily HWE) vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel (Wily HWE) vulnerabilities
Title: Linux kernel (Wily HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux k
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A re
Ubuntu
Linux kernel (Raspberry Pi 2) vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel (Raspberry Pi 2) vulnerabilities
Title: Linux kernel (Raspberry Pi 2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the L
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2016-06-10·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2016-06-01·CVSS 8.5
CVE-2015-4004 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A remote attacker could use
this to cause a denial of service (system crash) or obtain potentially
sensitive information from kernel memory. (CVE-2015-4004)
Andy Lutomirski discovered a race condition in the Linux kernel's
translation lookaside buffer (TLB) handling of flush events. A local
attacker could use this to cause a denial of service
Red Hat
kernel: ozwpan: multiple out-of-bounds read issues
vendor_redhat·2015-05-13·CVSS 8.5
CVE-2015-4004 [HIGH] CWE-130 kernel: ozwpan: multiple out-of-bounds read issues
kernel: ozwpan: multiple out-of-bounds read issues
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Statement: Red Hat Enterprise Linux is not affected by this flaw as the OZWPAN USB Host Controller driver (CONFIG_USB_WPAN_HCD) is not enabled in any current shipping kernels.
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Package: kernel-rt (Red Hat Enterprise Linux 7) - Not affected
Package: kernel (Red Hat Enterprise Linux 8) - Not affected
Package: kernel-rt (Red Hat Enterprise Lin
Debian
CVE-2015-4004: linux - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted lengt...
vendor_debian·2015·CVSS 8.5
CVE-2015-4004 [HIGH] CVE-2015-4004: linux - The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted lengt...
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
Scope: local
bookworm: resolved (fixed in 4.3-1)
bullseye: resolved (fixed in 4.3-1)
forky: resolved (fixed in 4.3-1)
sid: resolved (fixed in 4.3-1)
trixie: resolved (fixed in 4.3-1)
GHSA
GHSA-wchv-79w6-567f: The OZWPAN driver in the Linux kernel through 4
ghsa_unreviewed·2022-05-17
CVE-2015-4004 [HIGH] CWE-119 GHSA-wchv-79w6-567f: The OZWPAN driver in the Linux kernel through 4
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
OSV
linux-lts-utopic vulnerabilities
osv·2016-06-10·CVSS 8.5
CVE-2016-2117 [HIGH] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A remote attacker could use
this to cause a denial of service (syst
OSV
linux-lts-vivid vulnerabilities
osv·2016-06-10·CVSS 8.5
CVE-2016-2117 [HIGH] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A remote attacker could use
this to cause a denial of service (syste
OSV
linux-lts-wily vulnerabilities
osv·2016-06-10·CVSS 8.5
CVE-2016-2117 [HIGH] linux-lts-wily vulnerabilities
linux-lts-wily vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jann Horn discovered that eCryptfs improperly attempted to use the mmap()
handler of a lower filesystem that did not implement one, causing a
recursive page fault to occur. A local unprivileged attacker could use to
cause a denial of service (system crash) or possibly execute arbitrary code
with administrative privileges. (CVE-2016-1583)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A remote attacker could use
this to cause a denial of service (system
OSV
linux vulnerabilities
osv·2016-06-01·CVSS 8.5
CVE-2016-2117 [HIGH] linux vulnerabilities
linux vulnerabilities
Justin Yackoski discovered that the Atheros L2 Ethernet Driver in the Linux
kernel incorrectly enables scatter/gather I/O. A remote attacker could use
this to obtain potentially sensitive information from kernel memory.
(CVE-2016-2117)
Jason A. Donenfeld discovered multiple out-of-bounds reads in the OZMO USB
over wifi device drivers in the Linux kernel. A remote attacker could use
this to cause a denial of service (system crash) or obtain potentially
sensitive information from kernel memory. (CVE-2015-4004)
Andy Lutomirski discovered a race condition in the Linux kernel's
translation lookaside buffer (TLB) handling of flush events. A local
attacker could use this to cause a denial of service or possibly leak
sensitive information. (CVE-2016-2069)
Ralf Spenneberg
OSV
CVE-2015-4004: The OZWPAN driver in the Linux kernel through 4
osv·2015-06-07·CVSS 8.5
CVE-2015-4004 [HIGH] CVE-2015-4004: The OZWPAN driver in the Linux kernel through 4
The OZWPAN driver in the Linux kernel through 4.0.5 relies on an untrusted length field during packet parsing, which allows remote attackers to obtain sensitive information from kernel memory or cause a denial of service (out-of-bounds read and system crash) via a crafted packet.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
http://openwall.com/lists/oss-security/2015/06/05/7http://www.securityfocus.com/bid/74669http://www.ubuntu.com/usn/USN-2989-1http://www.ubuntu.com/usn/USN-2998-1http://www.ubuntu.com/usn/USN-3000-1http://www.ubuntu.com/usn/USN-3001-1http://www.ubuntu.com/usn/USN-3002-1http://www.ubuntu.com/usn/USN-3003-1http://www.ubuntu.com/usn/USN-3004-1https://lkml.org/lkml/2015/5/13/739http://openwall.com/lists/oss-security/2015/06/05/7http://www.securityfocus.com/bid/74669http://www.ubuntu.com/usn/USN-2989-1http://www.ubuntu.com/usn/USN-2998-1http://www.ubuntu.com/usn/USN-3000-1http://www.ubuntu.com/usn/USN-3001-1http://www.ubuntu.com/usn/USN-3002-1http://www.ubuntu.com/usn/USN-3003-1http://www.ubuntu.com/usn/USN-3004-1https://lkml.org/lkml/2015/5/13/739
2015-06-07
Published