CVE-2015-3636
MEDIUM 4.9EPSS 2.5%
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
- CVSS v2.0 NVD
- 4.9 MEDIUM
AV:L/AC:L/Au:N/C:N/I:N/A:C - EPSS
- 2.47% chance of exploitation in the next 30 days, 84th percentile
- Published
- 2015-08-06
- Updated
- 2024-08-06
Proof-of-concept exploits (5)
- a7vinx/CVE-2015-363620★ · 2017-01-03
- android-rooting-tools/libpingpong_exploit45★ · 2015-11-22
- askk/libping_unhash_exploit_POC3★ · 2015-08-20
- betalphafai/cve-2015-3636_crash4★ · 2015-07-25
- fi01/CVE-2015-3636135★ · 2015-12-15
Security advisories
- http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
- http://www.securityfocus.com/bid/74450
- http://www.ubuntu.com/usn/USN-2631-1
- http://www.ubuntu.com/usn/USN-2632-1
- http://www.ubuntu.com/usn/USN-2633-1
- http://www.ubuntu.com/usn/USN-2634-1