CVE-2015-4036
published 2015-08-31CVE-2015-4036: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of…
PriorityP427high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.59%
44.9th percentile
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.16.7-ckt9-1 (bookworm) | linux 3.16.7-ckt9-1 (bookworm) |
| linux | linux_kernel | < 3.10.90 | 3.10.90 |
| linux | linux_kernel | — | — |
| linux | linux_kernel | >= 0 < 3.16.7-ckt9-1 | 3.16.7-ckt9-1 |
| linux | linux_kernel | >= 0 < 3.16.7-ckt9-1 | 3.16.7-ckt9-1 |
| linux | linux_kernel | >= 0 < 3.16.7-ckt9-1 | 3.16.7-ckt9-1 |
| linux | linux_kernel | >= 0 < 3.16.7-ckt9-1 | 3.16.7-ckt9-1 |
| linux | linux_kernel | >= 0 < 3.13.0-54.91 | 3.13.0-54.91 |
| linux | linux_kernel | >= 3.11 < 3.12.44 | 3.12.44 |
| linux | linux_kernel | >= 3.13 < 3.14.57 | 3.14.57 |
| linux | linux_kernel | >= 3.15 < 3.16.35 | 3.16.35 |
| linux | linux_kernel | >= 3.17 < 3.18.25 | 3.18.25 |
| linux | linux_kernel | >= 3.19 < 4.0 | 4.0 |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_debian7.2HIGH
vendor_redhat7.2HIGH
vendor_ubuntu5.0MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2015-06-10·CVSS 4.9
CVE-2015-3636 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all thir
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-06-10·CVSS 4.9
CVE-2015-3636 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kerne
Ubuntu
Linux kernel (Vivid HWE) vulnerabilities
vendor_ubuntu·2015-06-10·CVSS 4.9
CVE-2015-0275 [MEDIUM] Linux kernel (Vivid HWE) vulnerabilities
Title: Linux kernel (Vivid HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Xiong Zhou discovered a bug in the way the EXT4 filesystem handles
fallocate zero range functionality when the page size is greater than the
block size. A local attacker could exploit this flaw to cause a denial of
service (system crash). (CVE-2015-0275)
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
Instructions:
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-06-10·CVSS 4.9
CVE-2015-0275 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Xiong Zhou discovered a bug in the way the EXT4 filesystem handles
fallocate zero range functionality when the page size is greater than the
block size. A local attacker could exploit this flaw to cause a denial of
service (system crash). (CVE-2015-0275)
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
Instructions: After a stan
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-04-09·CVSS 5.0
CVE-2015-1593 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An integer overflow was discovered in the stack randomization feature of
the Linux kernel on 64 bit platforms. A local attacker could exploit this
flaw to bypass the Address Space Layout Randomization (ASLR) protection
mechanism. (CVE-2015-1593)
An information leak was discovered in the Linux Kernel's handling of
userspace configuration of the link layer control (LLC). A local user could
exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)
An information leak was discovered in how the Linux kernel handles setting
the Reliable Datagram Sockets (RDS) settings. A local user could exploit
this flaw to read data from other sysctl settings. (CVE-2015-2042)
A memory corruption
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2015-04-09·CVSS 5.0
CVE-2015-1593 [MEDIUM] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
An integer overflow was discovered in the stack randomization feature of
the Linux kernel on 64 bit platforms. A local attacker could exploit this
flaw to bypass the Address Space Layout Randomization (ASLR) protection
mechanism. (CVE-2015-1593)
An information leak was discovered in the Linux Kernel's handling of
userspace configuration of the link layer control (LLC). A local user could
exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)
An information leak was discovered in how the Linux kernel handles setting
the Reliable Datagram Sockets (RDS) settings. A local user could exploit
this flaw to read data from other sysctl settings. (CVE-2015-2042)
A memo
Red Hat
kernel: potential memory corruption (denial of service) in vhost/scsi driver
vendor_redhat·2015-02-05·CVSS 7.2
CVE-2015-4036 [HIGH] CWE-119 kernel: potential memory corruption (denial of service) in vhost/scsi driver
kernel: potential memory corruption (denial of service) in vhost/scsi driver
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
A flaw exists in the kernels configfs interface to manipulate or control the vhost scsi subsection. Unchecked directory names in configfs may unintentionally corrupt memory or panic the system.
Statement: Not vulnerable. This issue did not affect the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 5, 6 and 7, and Red
Debian
CVE-2015-4036: linux - Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in ...
vendor_debian·2015·CVSS 7.2
CVE-2015-4036 [HIGH] CVE-2015-4036: linux - Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in ...
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
Scope: local
bookworm: resolved (fixed in 3.16.7-ckt9-1)
bullseye: resolved (fixed in 3.16.7-ckt9-1)
forky: resolved (fixed in 3.16.7-ckt9-1)
sid: resolved (fixed in 3.16.7-ckt9-1)
trixie: resolved (fixed in 3.16.7-ckt9-1)
GHSA
GHSA-f533-g6c5-65cx: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi
ghsa_unreviewed·2022-05-17
CVE-2015-4036 [HIGH] CWE-119 GHSA-f533-g6c5-65cx: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
OSV
CVE-2015-4036: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi
osv·2015-08-31·CVSS 7.2
CVE-2015-4036 [HIGH] CVE-2015-4036: Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi
Array index error in the tcm_vhost_make_tpg function in drivers/vhost/scsi.c in the Linux kernel before 4.0 might allow guest OS users to cause a denial of service (memory corruption) or possibly have unspecified other impact via a crafted VHOST_SCSI_SET_ENDPOINT ioctl call. NOTE: the affected function was renamed to vhost_scsi_make_tpg before the vulnerability was announced.
OSV
linux-lts-vivid vulnerabilities
osv·2015-06-10·CVSS 4.9
CVE-2015-0275 [MEDIUM] linux-lts-vivid vulnerabilities
linux-lts-vivid vulnerabilities
Xiong Zhou discovered a bug in the way the EXT4 filesystem handles
fallocate zero range functionality when the page size is greater than the
block size. A local attacker could exploit this flaw to cause a denial of
service (system crash). (CVE-2015-0275)
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
OSV
linux vulnerabilities
osv·2015-06-10·CVSS 4.9
CVE-2015-3636 [MEDIUM] linux vulnerabilities
linux vulnerabilities
Wen Xu discovered a use-after-free flaw in the Linux kernel's ipv4 ping
support. A local user could exploit this flaw to cause a denial of service
(system crash) or gain administrative privileges on the system.
(CVE-2015-3636)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A local attacker could potentially exploit this flaw to cause a
denial of service (system crash). (CVE-2015-4036)
OSV
linux-lts-utopic vulnerabilities
osv·2015-04-09·CVSS 5.0
CVE-2015-1593 [MEDIUM] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
An integer overflow was discovered in the stack randomization feature of
the Linux kernel on 64 bit platforms. A local attacker could exploit this
flaw to bypass the Address Space Layout Randomization (ASLR) protection
mechanism. (CVE-2015-1593)
An information leak was discovered in the Linux Kernel's handling of
userspace configuration of the link layer control (LLC). A local user could
exploit this flaw to read data from other sysctl settings. (CVE-2015-2041)
An information leak was discovered in how the Linux kernel handles setting
the Reliable Datagram Sockets (RDS) settings. A local user could exploit
this flaw to read data from other sysctl settings. (CVE-2015-2042)
A memory corruption flaw was discovered in the Linux kernel's scsi
subsystem. A lo
No detection rules found.
No public exploits indexed.
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719chttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.htmlhttp://www.openwall.com/lists/oss-security/2015/05/13/4http://www.securityfocus.com/bid/74664http://www.securitytracker.com/id/1033729http://www.ubuntu.com/usn/USN-2633-1http://www.ubuntu.com/usn/USN-2634-1https://bugzilla.redhat.com/show_bug.cgi?id=1189864https://github.com/torvalds/linux/commit/59c816c1f24df0204e01851431d3bab3eb76719chttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=59c816c1f24df0204e01851431d3bab3eb76719chttp://lists.opensuse.org/opensuse-security-announce/2015-07/msg00049.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00011.htmlhttp://www.openwall.com/lists/oss-security/2015/05/13/4http://www.securityfocus.com/bid/74664http://www.securitytracker.com/id/1033729http://www.ubuntu.com/usn/USN-2633-1http://www.ubuntu.com/usn/USN-2634-1https://bugzilla.redhat.com/show_bug.cgi?id=1189864https://github.com/torvalds/linux/commit/59c816c1f24df0204e01851431d3bab3eb76719c
2015-08-31
Published