CVE-2015-8812: Use After Free
A flaw was found in the CXGB3 kernel driver when the network was considered congested. The kernel would incorrectly misinterpret the congestion as an error condition and incorrectly free/clean up the skb. When the device would then send the skb's queued, these structures would be referenced and may panic the system or allow an attacker to escalate privileges in a use-after-free scenario.
From the patch:
----
The cxgb3send() functions return NETXMIT values, which are positive integers values. So don't treat positive return values as an error. ----
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=67f1aee6f45059fd6b0f5b0ecb2c97ad0451f6b3
CVE assignment: http://seclists.org/oss-sec/2016/q1/311
Other sources
drivers/infiniband/hw/cxgb3/iwchcm.c in the Linux kernel before 4.5 does not properly identify error conditions, which allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID is CVE-2015-8812.
What is the severity level of CVE-2015-8812?
The severity level of CVE-2015-8812 is medium (4).
How does CVE-2015-8812 affect Linux kernel versions?
CVE-2015-8812 affects Linux kernel versions before 4.5.
What is the impact of CVE-2015-8812?
CVE-2015-8812 allows remote attackers to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
How can I fix CVE-2015-8812?
To fix CVE-2015-8812, update your Linux kernel to version 4.5 or later.