CVE-2015-8961: Use After Free
First published: Mon Nov 07 2016(Updated: )
The __ext4_journal_stop function in fs/ext4/ext4_jbd2.c in the Linux kernel before 4.3.3 allows local users to gain privileges or cause a denial of service (use-after-free) by leveraging improper access to a certain error field.
Credit: security@android.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linux Linux kernel | >=3.10.85<3.12 | |
| Linux Linux kernel | >=3.12.46<3.12.52 | |
| Linux Linux kernel | >=3.14.49<3.14.59 | |
| Linux Linux kernel | >=3.18.20<3.18.54 | |
| Linux Linux kernel | >=4.1.4<4.1.15 | |
| Linux Linux kernel | >=4.2<4.2.8 | |
| Linux Linux kernel | >=4.3<4.3.3 | |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6934da9238da947628be83635e365df41064b09b
- https://source.android.com/docs/security/bulletin/2016-11-01 (Advisory)
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6934da9238da947628be83635e365df41064b09b
- http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.3.3
- http://www.securityfocus.com/bid/94135
- https://github.com/torvalds/linux/commit/6934da9238da947628be83635e365df41064b09b
- https://source.android.com/security/bulletin/2016-11-01.html
- collector/nvd-index
- agent/type
- agent/remedy
- agent/first-publish-date
- agent/references
- agent/author
- agent/severity
- agent/weakness
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/last-modified-date
- agent/tags
- agent/event
- collector/android-source
- source/Android
- vendor/linux
- canonical/linux linux kernel
- version/linux linux kernel/3.10.85
- version/linux linux kernel/3.12.46
- version/linux linux kernel/3.14.49
- version/linux linux kernel/3.18.20
- version/linux linux kernel/4.1.4
- version/linux linux kernel/4.2
- version/linux linux kernel/4.3
- vendor/google