NVD Vulnerability Detail

CVE-2015-3288

Summary	mm/memory.c in the Linux kernel before 4.1.4 mishandles anonymous pages, which allows local users to gain privileges or cause a denial of service (page tainting) via a crafted application that triggers writing to page zero.
Publication Date	Oct. 17, 2016, 6:59 a.m.
Registration Date	Jan. 26, 2021, 2:49 p.m.
Last Update	Nov. 21, 2024, 11:29 a.m.

Affected software configurations

Related information, measures and tools

No	URL	タグ
1	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d	Patch Vendor Advisory
2	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d	Patch Vendor Advisory
3	http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4	Release Notes Vendor Advisory
4	http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4	Release Notes Vendor Advisory
5	http://www.securityfocus.com/bid/93591	Third Party Advisory VDB Entry
6	http://www.securityfocus.com/bid/93591	Third Party Advisory VDB Entry
7	https://bugzilla.redhat.com/show_bug.cgi?id=1333830	Issue Tracking Patch Third Party Advisory VDB Entry
8	https://bugzilla.redhat.com/show_bug.cgi?id=1333830	Issue Tracking Patch Third Party Advisory VDB Entry
9	https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d	Vendor Advisory
10	https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d	Vendor Advisory
11	https://security-tracker.debian.org/tracker/CVE-2015-3288	Third Party Advisory
12	https://security-tracker.debian.org/tracker/CVE-2015-3288	Third Party Advisory
13	https://source.android.com/security/bulletin/2017-01-01.html	Third Party Advisory
14	https://source.android.com/security/bulletin/2017-01-01.html	Third Party Advisory

Common Vulnerabilities List

No	CWE	Name	URL
1	CWE-20	不適切な入力確認	https://cwe.mitre.org/data/definitions/20.html

JVN Vulnerability Information

Linux Kernel の mm/memory.c における権限を取得される脆弱性

Title	Linux Kernel の mm/memory.c における権限を取得される脆弱性
Summary	Linux Kernel の mm/memory.c は、匿名のページを誤って処理するため、権限を取得される、またはサービス運用妨害 (ページの汚染) 状態にされる脆弱性が存在します。
Possible impacts	ローカルユーザにより、ゼロページへの書き込みを誘発する巧妙に細工されたアプリケーションを介して、権限を取得される、またはサービス運用妨害 (ページの汚染) 状態にされる可能性があります。
Solution	ベンダより正式な対策が公開されています。ベンダ情報を参照して適切な対策を実施してください。
Publication Date	July 7, 2015, midnight
Registration Date	Oct. 20, 2016, 6 p.m.
Last Update	Oct. 20, 2016, 6 p.m.

Affected System

Linux

Linux Kernel 4.1.4 未満

CVE (情報セキュリティ共通脆弱性識別子)

No	Name	URL
Common Vulnerabilities and Exposures (CVE)
1	CVE-2015-3288	http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-3288
National Vulnerability Database (NVD)
2	CVE-2015-3288	http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2015-3288
Security Bug Tracker
3	CVE-2015-3288	https://security-tracker.debian.org/tracker/CVE-2015-3288

CWE (共通脆弱性タイプ一覧)

No	Name	URL
JVNDB
1	CWE-20	https://jvndb.jvn.jp/ja/cwe/CWE-20.html

ベンダー情報

No	Name	URL
ChangeLog
1	ChangeLog-4.1.4	https://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.4
GitHub
2	mm: avoid setting up anonymous pages into file mapping	https://github.com/torvalds/linux/commit/6b7339f4c31ad69c8e9c0b2859276e22cf72176d
Linux Kernel
3	Linux Kernel Archives	http://www.kernel.org
Linux kernel source tree
4	mm: avoid setting up anonymous pages into file mapping	http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6b7339f4c31ad69c8e9c0b2859276e22cf72176d
Red Hat Bugzilla
5	Bug 1333830	https://bugzilla.redhat.com/show_bug.cgi?id=1333830

Change Log

No	Changed Details	Date of change
0	[2016年10月20日] 掲載	Feb. 17, 2018, 10:37 a.m.