CVE-2015-3636: Use After Free
It was found that the Linux kernel's ping socket implementation didn't properly handle socket unhashing during spurious disconnects which could lead to use-after-free flaw.
On x86-64 architecture systems, a local user able to create ping sockets could use this flaw to crash the system.
On non-x86-64 architecture systems, a local user able to create ping sockets could use this flaw to increase their privileges on the system.
Note: By default ping sockets are disabled on the system (net.ipv4.pinggrouprange = 1 0) and have to be explicitly enabled by the system administrator for specific user groups in order to exploit this issue.
Upstream fix: https://github.com/torvalds/linux/commit/a134f083e79fb4c3d0a925691e732c56911b4326
References: http://www.openwall.com/lists/oss-security/2015/05/02/5
Other sources
The pingunhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCKDGRAM socket system call for the IPPROTOICMP or IPPROTOICMPV6 protocol, and then making a connect system call after a disconnect.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3636?
CVE-2015-3636 is considered a high severity vulnerability due to its potential to crash affected systems through a local user exploiting a use-after-free flaw.
How do I fix CVE-2015-3636?
To mitigate CVE-2015-3636, update the Linux kernel to a version that is not affected, specifically versions later than 4.0.2.
Which systems are affected by CVE-2015-3636?
CVE-2015-3636 affects Linux kernel versions up to 4.0.2, Debian GNU/Linux 7.0, Red Hat Enterprise Linux 6.0, and Ubuntu Linux 12.04.
What can an attacker do with CVE-2015-3636?
An attacker can use CVE-2015-3636 to create ping sockets that may lead to system crashes on vulnerable x86-64 architecture systems.
Is CVE-2015-3636 specific to a particular architecture?
Yes, CVE-2015-3636 is primarily a concern for systems running on the x86-64 architecture.