Vulnerability Details : CVE-2015-7312
Multiple race conditions in the Advanced Union Filesystem (aufs) aufs3-mmap.patch and aufs4-mmap.patch patches for the Linux kernel 3.x and 4.x allow local users to cause a denial of service (use-after-free and BUG) or possibly gain privileges via a (1) madvise or (2) msync system call, related to mm/madvise.c and mm/msync.c.
Vulnerability category: Memory CorruptionDenial of service
Threat overview for CVE-2015-7312
Top countries where our scanners detected CVE-2015-7312
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2015-7312 37,644
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2015-7312!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2015-7312
Probability of exploitation activity in the next 30 days: 0.04%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 6 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2015-7312
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.4
|
MEDIUM | AV:L/AC:M/Au:N/C:P/I:P/A:P |
3.4
|
6.4
|
NIST |
CWE ids for CVE-2015-7312
-
The product contains a code sequence that can run concurrently with other code, and the code sequence requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence that is operating concurrently.Assigned by: nvd@nist.gov (Primary)
-
Referencing memory after it has been freed can cause a program to crash, use unexpected values, or execute code.Assigned by: nvd@nist.gov (Primary)
References for CVE-2015-7312
-
http://www.debian.org/security/2015/dsa-3364
Debian -- Security Information -- DSA-3364-1 linuxThird Party Advisory
-
http://www.ubuntu.com/usn/USN-2777-1
USN-2777-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2015/09/22/10
oss-security - Re: CVE request: Use-after-free in Linux kernel with aufs mmap patchMailing List;Third Party Advisory
-
http://sourceforge.net/p/aufs/mailman/message/34449209/
aufs / Re: concurrent msync triggers NULL pointer dereferenceExploit;Third Party Advisory
Products affected by CVE-2015-7312
- cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*