CVE-2015-4700: Medium severity linux kernel vulnerability
A flaw was found in the kernels implementation of the Berkly Packet Filter. Specially crafted BPF code may be able to crash the system by creating a situation in which the JIT compiler will fail to correctly optimise the JIT image on the last pass. This would to the CPU executing instructions that were not part of the JIT code.
Workaround:
This issue does not affect most systems by default. An administrator would need to have enabled the BPF JIT to be affected.
It can be disabled immediately with the command:
echo 0 > /proc/sys/net/core/bpfjitenable
Or it can be disabled for all subsequent boots of the system by setting a value in /etc/sysctl.d/44-bpf-jit-disable
start file ##
net.core.bpfjitenable=0
end file ##
Resources:
http://seclists.org/oss-sec/2015/q2/784 https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/id=3f7352bf21f8fd7ba3e2fcef9488756f188e12be
Other sources
The bpfintjitcompile function in arch/x86/net/bpfjitcomp.c in the Linux kernel before 4.0.6 allows local users to cause a denial of service (system crash) by creating a packet filter and then loading crafted BPF instructions that trigger late convergence by the JIT compiler.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2015-4700?
CVE-2015-4700 is classified as a high severity vulnerability due to its potential to crash the system.
How do I fix CVE-2015-4700?
To mitigate CVE-2015-4700, users should upgrade the Linux kernel to versions 4.0.6 or higher, as well as install the specified patched versions in Debian packages.
What systems are affected by CVE-2015-4700?
CVE-2015-4700 affects Linux kernel versions up to and including 4.0.5, as well as specific Debian packages.
What types of attacks can be executed using CVE-2015-4700?
CVE-2015-4700 can be exploited to create specially crafted BPF code that leads to system crashes.
When was CVE-2015-4700 disclosed?
CVE-2015-4700 was disclosed in 2015, highlighting issues with the kernel's implementation of the Berkeley Packet Filter.