CVE-2015-8955

Description

arch/arm64/kernel/perf_event.c in the Linux kernel before 4.1 on arm64 platforms allows local users to gain privileges or cause a denial of service (invalid pointer dereference) via vectors involving events that are mishandled during a span of multiple HW PMUs.

CVSS Metrics

• v3.1•HIGH•Score: 7.3CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
• v2.0•MEDIUM•Score: 6.9AV:L/AC:M/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.06%• Percentile: 20%

Techniques & Countermeasures

• CWE-264•Permissions, Privileges, and Access Controls

  Weaknesses in this category are related to the management of permissions, privileges, and other security features that are used to perform access control.

Affected Systems

• google•android

  7.0

• linux•linux_kernel

  < 3.16.39 | ≥ 3.18, < 3.18.54 | ≥ 3.19, < 4.1

References (4)

• https://github.com/torvalds/linux/commit/8fff105e13041e49b82f92eef034f363a6b1c071
• http://source.android.com/security/bulletin/2016-10-01.html
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8fff105e13041e49b82f92eef034f363a6b1c071
• http://www.securityfocus.com/bid/93314