Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2015-1805

The (1) pipe_read and (2) pipe_write implementations in fs/pipe.c in the Linux kernel before 3.16 do not properly consider the side effects of failed __copy_to_user_inatomic and __copy_from_user_inatomic calls, which allows local users to cause a denial of service (system crash) or possibly gain privileges via a crafted application, aka an "I/O vector array overrun."

Published

2015-08-08T10:59:00.113

Last Modified

2025-04-12T10:46:40.837

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.2 (HIGH)

CVSSv2 Vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

  • Access Vector: LOCAL
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: COMPLETE
  • Integrity Impact: COMPLETE
  • Availability Impact: COMPLETE
Exploitability Score

3.9

Impact Score

10.0

Weaknesses
  • Type: Primary
    CWE-17
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Operating System google android 4.4.3 Yes
Operating System google android 5.0.1 Yes
Operating System google android 5.1 Yes
Operating System google android 5.1.1 Yes
Operating System google android 6.0 Yes
Operating System linux linux_kernel ≤ 3.15.10 Yes
References