CVE-2015-8539

CWE-269 — Improper Privilege ManagementCWE-66710 documents8 sources
Severity
7.8HIGH
EPSS
0.1%
top 78.29%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Linux Linux KernelCanonical Ubuntu LinuxSuse Linux Enterprise Real Time Extension
Timeline
PublishedFeb 8
Latest updateMay 13

Description

The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages3 packages

▶NVDlinux/linux_kernel< 4.4+1
▶Ubuntulinux< 3.13.0-161.211

Also affects: Ubuntu Linux 12.04, 14.04

Patches

Patch: www.openwall.com ↗Patch: github.com ↗Patch: www.openwall.com ↗

🔴Vulnerability Details

4
GHSA
GHSA-6m9m-6qjp-9mm8: The KEYS subsystem in the Linux kernel before 4↗2022-05-13
▶
OSV
linux vulnerabilities↗2018-10-23
▶
CVEList
CVE-2015-8539: The KEYS subsystem in the Linux kernel before 4↗2016-02-08
▶
OSV
CVE-2015-8539: The KEYS subsystem in the Linux kernel before 4↗2016-02-07
▶

📋Vendor Advisories

4
Ubuntu
Linux kernel vulnerabilities↗2018-10-23
▶
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities↗2018-10-23
▶
Red Hat
kernel: local privesc in key management↗2015-12-09
▶
Debian
CVE-2015-8539: linux - The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain pri...↗2015
▶

💬Community

1
Bugzilla
CVE-2015-8539 kernel: local privesc in key management↗2015-11-23
▶