kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | ||||||
|---|---|---|---|---|---|---|---|---|---|
| n/a | n/a | affected |
|
Configuration 1 [-]
|
| Package | CPE | Advisory | Released Date |
|---|---|---|---|
| Red Hat Enterprise Linux 6 | |||
| kernel-0:2.6.32-573.el6 | cpe:/o:redhat:enterprise_linux:6 | RHSA-2015:1272 | 2015-07-20T00:00:00Z |
No data available yet.
| Source | ID | Title |
|---|---|---|
Debian DLA |
DLA-155-1 | linux-2.6 security update |
Debian DSA |
DSA-3128-1 | linux security update |
EUVD |
EUVD-2014-7976 | arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value. |
Ubuntu USN |
USN-2490-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-2491-1 | Linux kernel (EC2) vulnerabilities |
Ubuntu USN |
USN-2492-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-2493-1 | Linux kernel (OMAP4) vulnerabilities |
Ubuntu USN |
USN-2515-1 | Linux kernel (Trusty HWE) vulnerabilities |
Ubuntu USN |
USN-2516-1 | Linux kernel vulnerabilities |
Ubuntu USN |
USN-2517-1 | Linux kernel (Utopic HWE) vulnerabilities |
Ubuntu USN |
USN-2518-1 | Linux kernel vulnerabilities |
No CVSS v4.0
No CVSS v3.1
No CVSS v3.0
This CVE is not in the KEV list.
Exploit prediction score: < 1% (0.583% probability within 30 days)
Key SSVC decision points have not yet been added.
No history.