CVE-2015-1421: Use After Free
An use after free flaw was found in the Linux kernel SCTP implementation handled auth keys reference counting during INIT collisions.
A remote user could use this flaw to crash the system or, though unlikely, escalate their privileges on the system.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=600ddd6825543962fb807884169e57b580dba208
Acknowledgements:
This issue was discovered by Sun Baoliang of Red Hat.
Other sources
Use-after-free vulnerability in the sctpassocupdate function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1421?
CVE-2015-1421 is considered a high severity vulnerability due to its potential to crash the system or allow privilege escalation.
How do I fix CVE-2015-1421?
To fix CVE-2015-1421, update the Linux kernel to a version that includes the patches addressing this issue.
What versions of the Linux kernel are affected by CVE-2015-1421?
CVE-2015-1421 affects specific versions of the Linux kernel ranging from 2.6.24 up to 3.18.8.
Can CVE-2015-1421 be exploited remotely?
Yes, CVE-2015-1421 can be exploited by remote users to execute malicious actions.
Is privilege escalation possible with CVE-2015-1421?
Although unlikely, CVE-2015-1421 may permit privilege escalation under certain conditions.