CVE-2015-8539: canonical ubuntu_linux Improper Privilege Management
Modified
AliasesSUSE-SU-2016:0336-1SUSE-SU-2016:0339-1UBUNTU-CVE-2015-8539
Published 08-02-2016Last modified 06-08-2024
Vulnerability summary
CVE-2015-8539 is a high (CVSS 7.8) Improper Privilege Management vulnerability in canonical ubuntu_linux. EPSS estimates a 0.42% chance of exploitation in the next 30 days, higher than 36.7% of scored vulnerabilities.
Priority
Routine
Not severe (CVSS 7.8, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v3.1 (NVD)EPSS score
0.42%
0%100%
Low · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 21 · Related 18OPENSUSE-SU-2024:10128-1RHSA-2018:0151RHSA-2018:0152RHSA-2018:0181SUSE-SU-2016:0168-1SUSE-SU-2016:0335-1SUSE-SU-2016:0337-1SUSE-SU-2016:0380-1SUSE-SU-2016:0381-1SUSE-SU-2016:0383-1SUSE-SU-2016:0384-1SUSE-SU-2016:0386-1SUSE-SU-2016:0387-1SUSE-SU-2016:0434-1SUSE-SU-2016:0585-1SUSE-SU-2016:0911-1SUSE-SU-2016:1102-1SUSE-SU-2016:1203-1SUSE-SU-2016:1937-1SUSE-SU-2016:2074-1USN-3798-1
Timeline
- 08-02-2016PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The KEYS subsystem in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (BUG) via crafted keyctl commands that negatively instantiate a key, related to security/keys/encrypted-keys/encrypted.c, security/keys/trusted.c, and security/keys/user_defined.c.
CVSS metrics
4 scores · 2 sources · 3 versionsHigh 7.8Preferred score · NVD (NIST)
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesAll 2 agree
- OSV · UbuntuEcosystem advisory · calculated7.8HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
High 7.8Preferred score · OSV · Ubuntu (Ecosystem advisory) · calculated from vector
CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSourcesSingle source
High 7.2Preferred score · NVD (NIST)
AV:L/AC:L/Au:N/C:C/I:C/A:CSourcesSingle source
EPSS trend
Probability
0.42%
Chance of exploitation in the next 30 days
Percentile
37%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.42% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Version check
Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.
Suse3 products
- kgraft-patch-SLE12_Update_9&distro=SUSE Linux Enterprise Live Patching 12< 2-2.1
- kgraft-patch-SLE12-SP1_Update_1&distro=SUSE Linux Enterprise Live Patching 12< 2-2.1
- linux_enterprise_real_time_extension12:sp1
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04
Linux1 product
- linux_kernel< 4.4 | 4.4:rc1 | 4.4:rc2
Ubuntu1 product
- linux< 3.13.0-161.211
4 vendors · 6 products
References
32 links- lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- bugzilla.redhat.com/show_bug.cgi?id=1284450X Refsource CONFIRMIssue TrackingThird Party AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- github.com/torvalds/linux/commit/096fe9eaea40a17e125569f9e657e34cdb6d73bdX Refsource CONFIRMIssue TrackingPatchVendor Advisory
- www.openwall.com/lists/oss-security/2015/12/09/1Mailing ListX Refsource MLISTIssue TrackingPatchThird Party AdvisoryREPORT
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
Show all 32 references
- lists.opensuse.org/opensuse-security-announce/2016-04/msg00045.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00011.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00038.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00008.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-08/msg00000.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2016-03/msg00094.htmlVendor AdvisoryX Refsource SUSEThird Party Advisory
- bugzilla.suse.com/958601REPORT