First published: Tue Sep 15 2015(Updated: )
It was found that the Linux kernel's Reliable Datagram Sockets (RDS) protocol implementation did not verify that an underlying transport exists when creating a connection to a remote server. This could happen on sockets that were not properly bound before attempting to send a message. A local attacker could use this flaw to crash the system by creating sockets at specific times to trigger a NULL pointer dereference on the system. Upstream patch: <a href="https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=74e98eb085889b0d2d4908f59f6e00026063014f">https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=74e98eb085889b0d2d4908f59f6e00026063014f</a> CVE assignment: <a href="http://seclists.org/oss-sec/2015/q3/545">http://seclists.org/oss-sec/2015/q3/545</a>
Credit: cve@mitre.org cve@mitre.org
Affected Software | Affected Version | How to fix |
---|---|---|
Linux Linux kernel | <=4.2.3 | |
Canonical Ubuntu Linux | =12.04 | |
Canonical Ubuntu Linux | =14.04 | |
Debian Debian Linux | =7.0 | |
Debian Debian Linux | =8.0 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.5-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
The vulnerability ID is CVE-2015-6937.
CVE-2015-6937 has a medium severity rating.
CVE-2015-6937 allows local users to cause a denial of service or possibly have other unspecified impact by using a socket that was not properly bound.
The Linux kernel versions through 4.2.3 are affected.
Update your Linux kernel to version 4.3 or higher.