CVE-2015-6252: Low severity linux kernel vulnerability
A flaw was found in the way the Linux kernel's vhost driver treated userspace provided log file descriptor when processing the VHOSTSETLOGFD ioctl command. The file descriptor was never released and continued to consume kernel memory. A privileged local user with access to the /dev/vhost-net files could use this flaw to create a denial-of-service attack.
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=7932c0bd7740f4cd2aa168d3ce0199e7af7d72d5
Other sources
The vhostdevioctl function in drivers/vhost/vhost.c in the Linux kernel before 4.1.5 allows local users to cause a denial of service (memory consumption) via a VHOSTSETLOGFD ioctl call that triggers permanent file-descriptor allocation.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2015-6252.
What is the description of CVE-2015-6252?
CVE-2015-6252 is a vulnerability in the vhost_dev_ioctl function in the Linux kernel before 4.1.5 that allows local users to cause a denial of service (memory consumption) via a VHOST_SET_LOG_FD ioctl call that triggers permanent file-descriptor allocation.
How severe is CVE-2015-6252?
CVE-2015-6252 has a severity level of low.
Which software versions are affected by CVE-2015-6252?
CVE-2015-6252 affects Linux kernel versions 3.2.0-91.129, 3.13.0-65.105, 4.2~, 3.19.0-30.33, 3.2.0-1656.78, as well as various other versions and distributions.
How can I fix CVE-2015-6252?
To fix CVE-2015-6252, you should update your Linux kernel to version 4.1.5 or later.