CVE-2015-4170: linux linux_kernel Race Condition
CVSS: 4.7v3.0MediumModified
AliasesRHSA-2016:1395UBUNTU-CVE-2015-4170DEBIAN-CVE-2015-4170
Published 02-05-2016Last modified 06-08-2024
Vulnerability summary
CVE-2015-4170 is a medium (CVSS 4.7) Race Condition vulnerability in linux linux_kernel. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.1% of scored vulnerabilities.
CVSS score
4.7/10
010
Medium · v3.0 (NVD)EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 2Timeline
- 02-05-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
Race condition in the ldsem_cmpxchg function in drivers/tty/tty_ldsem.c in the Linux kernel before 3.13-rc4-next-20131218 allows local users to cause a denial of service (ldsem_down_read and ldsem_down_write deadlock) by establishing a new tty thread during shutdown of a previous tty thread.
CVSS metrics
4 scores · 3 sources · 2 versionsMedium 4.7Preferred score · NVD (NIST)
CVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:HSourcesAll 3 agree
- OSV · UbuntuEcosystem advisory · calculated4.7MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated4.7MediumCVSS:3.0/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:H
Medium 4.7Preferred score · NVD (NIST)
AV:L/AC:M/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
0.33%
Chance of exploitation in the next 30 days
Percentile
24%
Versus all other CVEs
30-day change
0.00 pp
From 0.33% on 19-09-2026
19-09-202619-10-2026
EPSS score0.33%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Redhat30 products
- enterprise_linux_compute_node_eus7.1
- enterprise_linux_for_ibm_z_systems_eus7.1_s390x
- enterprise_linux_for_power_big_endian_eus7.1_ppc64
- enterprise_linux_for_power_little_endian_eus7.1_ppc64le
- enterprise_linux_server_eus7.1
Ubuntu10 products
- linux< 3.13.0-1.16 | < 4.2.0-16.19
- linux-aws< 4.4.0-1002.2 | < 4.4.0-1001.10
- linux-gke< 4.4.0-1003.3
- linux-hwe< 4.8.0-36.36~16.04.1
- linux-lts-utopic< 3.16.0-25.33~14.04.2
Debian1 product
- linux< 3.13.4-1
Linux1 product
- linux_kernel≤ 3.13.3
4 vendors · 42 products
References
17 links- www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.htmlX Refsource CONFIRM
- github.com/torvalds/linux/commit/cf872776fc84128bb779ce2b83a37c884c3203aeX Refsource CONFIRM
- access.redhat.com/errata/RHSA-2016:1395Vendor AdvisoryX Refsource REDHATThird Party AdvisoryAdvisory
Show all 17 references
- git.kernel.org/cgit/…REPORT
