CVE-2015-5706: canonical ubuntu_linux Use After Free

Modified

AliasesUBUNTU-CVE-2015-5706DEBIAN-CVE-2015-5706

Published 31-08-2015Last modified 06-08-2024

Vulnerability summary

CVE-2015-5706 is a medium (CVSS 4.6) Use After Free vulnerability in canonical ubuntu_linux. EPSS estimates a 0.44% chance of exploitation in the next 30 days, higher than 37.9% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.6, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.6/10

010

Medium · v2.0 (NVD)

EPSS score

0.44%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 6 · Related 3

MGASA-2015-0386 MGASA-2015-0390 MGASA-2016-0015 USN-2664-1 USN-2665-1 USN-2681-1

Timeline

31-08-2015
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Use-after-free vulnerability in the path_openat function in fs/namei.c in the Linux kernel 3.x and 4.x before 4.0.4 allows local users to cause a denial of service or possibly have unspecified other impact via O_TMPFILE filesystem operations that leverage a duplicate cleanup operation.

CVSS metrics

1 score · 1 source · 1 version

v2.04.6

EPSS trend

Probability

0.44%

Chance of exploitation in the next 30 days

Percentile

38%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.44% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-416Use After FreeThe product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

Affected systems

Version check

Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.

Ubuntu3 products

linux< 3.13.0-58.97
linux-lts-utopic< 3.16.0-43.58~14.04.1
linux-lts-vivid< 3.19.0-22.22~14.04.1

Debian2 products

linux< 4.0.4-1
debian_linuxEOL7.0 | 8.0

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04

Linux1 product

linux_kernel≥ 3.0, ≤ 3.19.8 | ≥ 4.0, < 4.0.4

4 vendors · 7 products

References

20 links

source.android.com/security/bulletin/2017-01-01.htmlX Refsource CONFIRMPatchThird Party Advisory
twitter.com/grsecurity/statuses/597127122910490624X Refsource MISCBroken Link
www.ubuntu.com/usn/USN-2680-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.4X Refsource CONFIRMRelease NotesVendor Advisory
bugzilla.redhat.com/show_bug.cgi?id=1250047X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
www.securityfocus.com/bid/76142VDB EntryX Refsource BIDThird Party Advisory
www.debian.org/security/2015/dsa-3329Vendor AdvisoryX Refsource DEBIANThird Party Advisory
github.com/torvalds/linux/commit/f15133df088ecadd141ea1907f2c96df67c729f0X Refsource CONFIRMPatchThird Party Advisory
git.kernel.org/cgit/…X Refsource CONFIRMPatchVendor Advisory
www.ubuntu.com/usn/USN-2681-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory

Show all 20 references

www.openwall.com/lists/oss-security/2015/08/01/5Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
ubuntu.com/security/CVE-2015-5706REPORT
twitter.com/grsecurity/status/597127122910490624REPORT
ubuntu.com/security/notices/USN-2664-1Advisory
ubuntu.com/security/notices/USN-2665-1Advisory
ubuntu.com/security/notices/USN-2667-1Advisory
ubuntu.com/security/notices/USN-2680-1Advisory
ubuntu.com/security/notices/USN-2681-1Advisory
www.cve.org/CVERecord?id=CVE-2015-5706REPORT
security-tracker.debian.org/tracker/CVE-2015-5706Advisory