| Vulnerability Name: | CVE-2015-3290 (CCN-105346) | ||||||||||||||||||||||||||||
| Assigned: | 2015-08-05 | ||||||||||||||||||||||||||||
| Published: | 2015-08-05 | ||||||||||||||||||||||||||||
| Updated: | 2017-09-17 | ||||||||||||||||||||||||||||
| Summary: | arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window. | ||||||||||||||||||||||||||||
| CVSS v3 Severity: | 8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) 7.6 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C)
| ||||||||||||||||||||||||||||
| CVSS v2 Severity: | 7.2 High (CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C)
| ||||||||||||||||||||||||||||
| Vulnerability Type: | CWE-264 | ||||||||||||||||||||||||||||
| Vulnerability Consequences: | Gain Privileges | ||||||||||||||||||||||||||||
| References: | Source: MITRE Type: CNA CVE-2015-3290 Source: CONFIRM Type: UNKNOWN http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a Source: SUSE Type: UNKNOWN openSUSE-SU-2015:1382 Source: DEBIAN Type: UNKNOWN DSA-3313 Source: CONFIRM Type: Vendor Advisory http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.1.6 Source: MLIST Type: UNKNOWN [oss-security] 20150722 Linux x86_64 NMI security issues Source: MLIST Type: UNKNOWN [oss-security] 20150804 CVE-2015-3290: Linux privilege escalation due to nested NMIs interrupting espfix64 Source: BID Type: UNKNOWN 76004 Source: CCN Type: BID-76004 Linux Kernel 'x86/entry/entry_64.S' Local Privilege Escalation Vulnerability Source: UBUNTU Type: UNKNOWN USN-2687-1 Source: UBUNTU Type: UNKNOWN USN-2688-1 Source: UBUNTU Type: UNKNOWN USN-2689-1 Source: UBUNTU Type: UNKNOWN USN-2690-1 Source: UBUNTU Type: UNKNOWN USN-2691-1 Source: CCN Type: Red Hat Bugzilla Bug 1243465 (CVE-2015-3290) CVE-2015-3290 kernel: x86: nested NMI handler and espfix64 interaction privilege escalation Source: CONFIRM Type: UNKNOWN https://bugzilla.redhat.com/show_bug.cgi?id=1243465 Source: XF Type: UNKNOWN linux-kernel-cve20153290-priv-esc(105346) Source: CCN Type: Linux Kernel GIT Repository x86/nmi/64: Switch stacks on userspace NMI entry Source: CONFIRM Type: UNKNOWN https://github.com/torvalds/linux/commit/9b6e6a8334d56354853f9c255d1395c2ba570e0a Source: CCN Type: Packet Storm Security [08-07-2015] Linux Nested NMIs Privilege Escalation Source: EXPLOIT-DB Type: EXPLOIT Offensive Security Exploit Database [08-05-2015] Source: EXPLOIT-DB Type: UNKNOWN 37722 | ||||||||||||||||||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||||||||||||||||||
| Oval Definitions | |||||||||||||||||||||||||||||
| |||||||||||||||||||||||||||||
| BACK | |||||||||||||||||||||||||||||