Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.

Several vulnerabilities have been discovered in the Linux kernel that may lead to a privilege escalation, denial of service or information leak.

  - CVE-2015-1333     Colin Ian King discovered a flaw in the add_key function     of the Linux kernel's keyring subsystem. A local user     can exploit this flaw to cause a denial of service due     to memory exhaustion.

  - CVE-2015-3212     Ji Jianwen of Red Hat Engineering discovered a flaw in     the handling of the SCTPs automatic handling of dynamic     multi-homed connections. A local attacker could use this     flaw to cause a crash or potentially for privilege     escalation.

  - CVE-2015-4692     A NULL pointer dereference flaw was found in the     kvm_apic_has_events function in the KVM subsystem. A     unprivileged local user could exploit this flaw to crash     the system kernel resulting in denial of service.

  - CVE-2015-4700     Daniel Borkmann discovered a flaw in the Linux kernel     implementation of the Berkeley Packet Filter which can     be used by a local user to crash the system.

  - CVE-2015-5364     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     could exploit this flaw to cause a denial of service     using a flood of UDP packets with invalid checksums.

  - CVE-2015-5366     It was discovered that the Linux kernel does not     properly handle invalid UDP checksums. A remote attacker     can cause a denial of service against applications that     use epoll by injecting a single packet with an invalid     checksum.

  - CVE-2015-5697     A flaw was discovered in the md driver in the Linux     kernel leading to an information leak.

  - CVE-2015-5706     An user triggerable use-after-free vulnerability in path     lookup in the Linux kernel could potentially lead to     privilege escalation.

  - CVE-2015-5707     An integer overflow in the SCSI generic driver in the     Linux kernel was discovered. A local user with write     permission on a SCSI generic device could potentially     exploit this flaw for privilege escalation.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2681-1 advisory.

    A flaw was discovered in the user space memory copying for the pipe iovecs in the Linux kernel. An     unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially     escalate their privileges. (CVE-2015-1805)

    A flaw was discovered in the kvm (kernel virtual machine) subsystem's kvm_apic_has_events function. A     unprivileged local user could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4692)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker could     exploit this flaw to cause a denial of service using a flood of UDP packets with invalid checksums.
    (CVE-2015-5364)

    A flaw was discovered in how the Linux kernel handles invalid UDP checksums. A remote attacker can cause a     denial of service against applications that use epoll by injecting a single packet with an invalid     checksum. (CVE-2015-5366)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2665-1 advisory.

    A race condition was discovered in the Linux kernel's file_handle size verification. A local user could     exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

    A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver.
    A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

    A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or     potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

    A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4003)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Ubuntu 14.04 LTS host has a package installed that is affected by multiple vulnerabilities as referenced in the USN-2664-1 advisory.

    A race condition was discovered in the Linux kernel's file_handle size verification. A local user could     exploit this flaw to read potentially sensative memory locations. (CVE-2015-1420)

    A underflow error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller driver.
    A remote attacker could exploit this flaw to cause a denial of service (system crash) or potentially     execute arbitrary code via a specially crafted packet. (CVE-2015-4001)

    A bounds check error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash) or     potentially execute arbitrary code via a specially crafted packet. (CVE-2015-4002)

    A division by zero error was discovered in the Linux kernel's Ozmo Devices USB over WiFi host controller     driver. A remote attacker could exploit this flaw to cause a denial of service (system crash).
    (CVE-2015-4003)

    Carl H Lunde discovered missing consistency checks in the Linux kernel's UDF file system (CONFIG_UDF_FS).
    A local attacker could exploit this flaw to cause a denial of service (system crash) by using a corrupted     file system image. (CVE-2015-4167)

    Daniel Borkmann reported a kernel crash in the Linux kernel's BPF filter JIT optimization. A local     attacker could exploit this flaw to cause a denial of service (system crash). (CVE-2015-4700)

    A double free flaw was discovered in the Linux kernel's path lookup. A local user could cause a denial of     service (Oops). (CVE-2015-5706)

Tenable has extracted the preceding description block directly from the Ubuntu security advisory.

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Severity
85281	Debian DSA-3329-1 : linux - security update	Nessus	Debian Local Security Checks	high
84982	Ubuntu 14.04 LTS : Linux kernel vulnerabilities (USN-2681-1)	Nessus	Ubuntu Local Security Checks	critical
84616	Ubuntu 14.04 LTS : Linux kernel (Vivid HWE) vulnerabilities (USN-2665-1)	Nessus	Ubuntu Local Security Checks	high
84615	Ubuntu 14.04 LTS : Linux kernel (Utopic HWE) vulnerabilities (USN-2664-1)	Nessus	Ubuntu Local Security Checks	medium

Detections

Analytics

CVE-2015-5706

medium

Tenable Plugins

high

critical

high

medium