CVE-2015-1465: High severity linux kernel vulnerability
It was found that routing packets to too many different dsts/too fast can lead to a excessive resource consumption.
A remote attacker can use this flaw to crash the system.
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f88649721268999bdff09777847080a52004f691
Acknowledgements:
This issue was found by Marcelo Ricardo Leitner of Red Hat.
Other sources
The IPv4 implementation in the Linux kernel before 3.18.8 does not properly consider the length of the Read-Copy Update (RCU) grace period for redirecting lookups in the absence of caching, which allows remote attackers to cause a denial of service (memory consumption or system crash) via a flood of packets.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-1465?
CVE-2015-1465 has a high severity rating due to its potential to cause excessive resource consumption and system crashes.
How do I fix CVE-2015-1465?
To mitigate CVE-2015-1465, update the Linux kernel to a version that includes the patch, such as 5.10.223-1 or later.
Which software versions are affected by CVE-2015-1465?
CVE-2015-1465 affects multiple Linux kernel versions, specifically those from 3.10.50 up to but not including 3.10.70, and several other specified versions.
Can CVE-2015-1465 be exploited remotely?
Yes, CVE-2015-1465 can be exploited remotely by attackers sending specially crafted packets.
What are the potential impacts of CVE-2015-1465?
The potential impacts of CVE-2015-1465 include system unavailability and crashes due to resource exhaustion.