drivers/infiniband/hw/cxgb3/iwch_cm.c in the Linux kernel prior to 4.5 does not properly identify error conditions, which allows remote malicious users to execute arbitrary code or cause a denial of service (use-after-free) via crafted packets.
| Vulnerable Product | Search on Vulmon | Subscribe to Product |
|---|---|---|
novell suse linux enterprise real time extension 12 |
||
linux linux kernel |
||
canonical ubuntu linux 15.10 |
||
canonical ubuntu linux 14.04 |
||
canonical ubuntu linux 12.04 |
This is kind of a big deal because the mess is in 14.04 LTS, expiry date 2019
Ubuntu has patched four Linux kernel vulnerabilities that allowed for arbitrary code execution and denial of service attacjs. The flaws (CVE-2015-8812, CVE-2016-2085, CVE-2016-2550, CVE-2016-2847) is fixed in Ubuntu 14.04 LTS. Researcher Venkatesh Pottem found a use-after-free vulnerability in the Linux kernel CXGB3 driver which local hackers could use to trigger a crash or execute arbitrary code. Xiaofei Rex Guo reported a second timing side channel vulnerability in the Linux Extended Verificat...
Vulmon