| Revision Date: | 2017-03-03 | Version: | 1 | | Title: | CVE-2015-2877 on Ubuntu 12.04 LTS (precise) - low. | | Description: | ** DISPUTED ** Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities. | | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2015-2877
| | Platform(s): | Ubuntu 12.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 12.04 LTS (precise) is installed. AND Package Information
The 'linux' package in precise is affected, but a decision has been made to defer addressing it (note: '2016-06-01').
OR The 'linux-armadaxp' package in precise is affected, but a decision has been made to defer addressing it.
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'end-of-life').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'was needs-triage now end-of-life').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'end-of-life').
OR The 'linux-lts-trusty' package in precise is affected, but a decision has been made to defer addressing it.
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR The 'linux-ti-omap4' package in precise is affected, but a decision has been made to defer addressing it.
|
|