Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2015-3331: Linux kernel <3.19.3 can crash or be taken over

CVE-2015-3331 · published 11 years ago

Summary

The early versions of the Linux kernel (including Debian and Ubuntu builds) have a mistake in the code that handles encrypted data. This flaw can cause the system to stop working or, in rare cases, let an attacker run their own code. Updating the kernel to version 3.19.3 or later removes the problem.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
linux	linux_kernel	< 3.2.69 >= 3.3, < 3.4.108 >= 3.5, < 3.10.73 >= 3.12, < 3.12.40 >= 3.13, < 3.14.37 >= 3.15, < 3.16.35 >= 3.17, < 3.18.11 >= 3.19, < 3.19.3 `cpe:2.3:o:linux:linux_kernel::::::::`
debian	debian_linux	7.0 8.0 `cpe:2.3:o:debian:debian_linux:7.0:::::::*`
canonical	ubuntu_linux	12.04 `cpe:2.3:o:canonical:ubuntu_linux:12.04::::-:::`

Original advisory text

The __driver_rfc4106_decrypt function in arch/x86/crypto/aesni-intel_glue.c in the Linux kernel before 3.19.3 does not properly determine the memory locations used for encrypted data, which allows context-dependent attackers to cause a denial of service (buffer overflow and system crash) or possibly execute arbitrary code by triggering a crypto API call, as demonstrated by use of a libkcapi test program with an AF_ALG(aead) socket.

References

http://rhn.redhat.com/errata/RHSA-2015-1081.html Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=...
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.html Issue Tracking Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00007.html Issue Tracking Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00008.html Issue Tracking Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00009.html Issue Tracking Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2015-09/msg00011.html Issue Tracking Third Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1199.html Third Party Advisory
http://www.debian.org/security/2015/dsa-3237 Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.19.3 Vendor Advisory
http://www.openwall.com/lists/oss-security/2015/04/14/16 Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.h... Third Party Advisory
http://www.securitytracker.com/id/1032416 Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2631-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2632-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1213322 Issue Tracking
https://github.com/torvalds/linux/commit/ccfe8c3f7e52ae83155cb038753f4c75b774ca8... Third Party Advisory

Fix within

Internet-facing 14 days

Internal At next upgrade

Not known to be exploited
Needs hands-on effort to exploit (estimated)
Gives an attacker full control (estimated)

Severity

9.3 Critical

Exploitation

10% chance of attack within 30 days

Type

CWE-119Buffer Overflow

Timeline

Published27 May 2015

Updated22 Oct 2026

First seen29 Sep 2026

Sources

CVE-2015-3331 · NVD

Track software like this

Free during beta