| Revision Date: | 2017-03-03 | Version: | 1 | | Title: | CVE-2015-2877 on Ubuntu 16.04 LTS (xenial) - low. | | Description: | ** DISPUTED ** Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities. | | Family: | unix | Class: | vulnerability | | Status: | | Reference(s): | CVE-2015-2877
| | Platform(s): | Ubuntu 16.04 LTS
| Product(s): | | | Definition Synopsis | | Ubuntu 16.04 LTS (xenial) is installed. AND Package Information
The 'linux' package in xenial is affected, but a decision has been made to defer addressing it (note: '2018-10-01').
OR The 'linux-aws' package in xenial is affected, but a decision has been made to defer addressing it.
OR The 'linux-azure' package in xenial is affected, but a decision has been made to defer addressing it (note: '2018-10-01').
OR The 'linux-azure-edge' package in xenial is affected, but a decision has been made to defer addressing it (note: '2018-10-01').
OR The 'linux-euclid' package in xenial is affected, but a decision has been made to defer addressing it.
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR The 'linux-gcp' package in xenial is affected, but a decision has been made to defer addressing it.
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'was needed now end-of-life').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR The 'linux-hwe' package in xenial is affected, but a decision has been made to defer addressing it.
OR The 'linux-hwe-edge' package in xenial is affected, but a decision has been made to defer addressing it.
OR The 'linux-kvm' package in xenial is affected, but a decision has been made to defer addressing it.
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'abandoned').
OR While related to the CVE in some way, a decision has been made to ignore it (note: 'end-of-life').
OR The 'linux-raspi2' package in xenial is affected, but a decision has been made to defer addressing it.
OR The 'linux-snapdragon' package in xenial is affected, but a decision has been made to defer addressing it.
|
|