CVE-2015-1339: Medium severity Linux Linux kernel vulnerability
Kernel memory leak in the CUSE driver using stress-ng was found. It is possible for privileged attacker to cause a local DoS via memory exhaustion by repeatedly opening /dev/cuse for reading.
Upstream patch:
https://git.kernel.org/linus/2c5816b4beccc8ba709144539f6fdd764f8fa49c
References:
https://bugzilla.novell.com/showbug.cgi?id=969356
http://seclists.org/oss-sec/2016/q1/495
Other sources
Memory leak in the cusechannelrelease function in fs/fuse/cuse.c in the Linux kernel before 4.4 allows local users to cause a denial of service (memory consumption) or possibly have unspecified other impact by opening /dev/cuse many times.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1339?
CVE-2015-1339 has been classified as a medium severity vulnerability due to its potential for local denial of service through memory exhaustion.
How do I fix CVE-2015-1339?
To mitigate CVE-2015-1339, ensure that your kernel is updated to a version that has patched this issue, such as 5.10.218-1 or later.
Which systems are affected by CVE-2015-1339?
CVE-2015-1339 affects Linux kernel versions prior to certain patched versions, specifically those listed in the affected software section.
What type of attack is possible with CVE-2015-1339?
An attacker can exploit CVE-2015-1339 to locally cause a denial of service by exhausting system memory.
Is CVE-2015-1339 a vulnerability with remote exploitation potential?
No, CVE-2015-1339 is a local vulnerability that requires privileged access to exploit.