CVE-2015-1339 : Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux

Memory leak in the cuse_channel_release function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.

Published 2016-04-27 17:59:00

Updated 2016-12-01 02:59:20

Source Canonical Ltd.

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2015-1339

Novell » Suse Linux Enterprise Debuginfo » Version: 11 Update SP4
cpe:2.3:o:novell:suse_linux_enterprise_debuginfo:11:sp4:*:*:*:*:*:*
Matching versions
Novell » Suse Linux Enterprise Real Time Extension » Version: 11 Update SP4
cpe:2.3:o:novell:suse_linux_enterprise_real_time_extension:11:sp4:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions up to, including, (<=) 4.3.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2015-1339

EPSS FAQ

0.12%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 44 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2015-1339

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.9	MEDIUM	AV:L/AC:L/Au:N/C:N/I:N/A:C	3.9	6.9	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: None Integrity Impact: None Availability Impact: Complete
6.2	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	2.5	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2015-1339

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2015-1339

https://github.com/torvalds/linux/commit/2c5816b4beccc8ba709144539f6fdd764f8fa49c

cuse: fix memory leak · torvalds/linux@2c5816b · GitHub
Patch;Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1314331

1314331 – (CVE-2015-1339) CVE-2015-1339 kernel: Memory exhaustion via CUSE driver
Issue Tracking
http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00015.html

[security-announce] openSUSE-SU-2016:1008-1: important: Security update

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2016/03/02/13

oss-security - CVE-2015-1339: Linux Kernel: memory exhaustion via CUSE driver
Patch
https://bugzilla.novell.com/show_bug.cgi?id=969356

Bug 969356 – VUL-0: CVE-2015-1339: kernel: Memory exhaustion via CUSE driver
Issue Tracking
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2c5816b4beccc8ba709144539f6fdd764f8fa49c

kernel/git/torvalds/linux.git - Linux kernel source tree
http://lists.opensuse.org/opensuse-security-announce/2016-06/msg00059.html

[security-announce] SUSE-SU-2016:1707-1: important: Security update for
Third Party Advisory

CVEs referencing this url
https://security-tracker.debian.org/tracker/CVE-2015-1339

CVE-2015-1339

Jump to

Vulnerability Details : CVE-2015-1339

Products affected by CVE-2015-1339

Exploit prediction scoring system (EPSS) score for CVE-2015-1339

CVSS scores for CVE-2015-1339

CWE ids for CVE-2015-1339

References for CVE-2015-1339