CVE-2015-1421 Use after free in n/a
Remote attackers can cause a denial of service or potentially execute code via a use-after-free vulnerability in the Linux kernel SCTP implementation.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-1421?
CVE-2015-1421 is a critical use after free vulnerability in Canonical Ubuntu Linux, published on 16 Mar 2015. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Use-after-free vulnerability in the sctp_assoc_update function in net/sctp/associola.c in the Linux kernel before 3.18.8 allows remote attackers to cause a denial of service (slab corruption and panic) or possibly have unspecified other impact by triggering an INIT collision that leads to improper handling of shared-key data.
Which versions are affected by CVE-2015-1421?
It affects 3 products.
Linux distribution packages (16)
kernel Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-debug Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-debug-debuginfo Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-debug-devel Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-debuginfo Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-debuginfo-common-x86_64 Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-devel Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-doc Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-firmware Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kernel-headers Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
perf Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
perf-debuginfo Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
python-perf Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
python-perf-debuginfo Red Hat:rhel_aus:6.4::server | All versions | 0:2.6.32-358.61.1.el6 |
kgraft-patch-SLE12_Update_1 SUSE:Linux Enterprise Live Patching 12 | All versions | 2-3.1 |
kgraft-patch-SLE12_Update_2 SUSE:Linux Enterprise Live Patching 12 | All versions | 2-3.1 |
Products include Canonical Ubuntu Linux, Debian Debian Linux, Linux kernel.
How do I fix CVE-2015-1421?
Apply the vendor's patch.
Upgrade to the fixed version. These bugs are found with fuzzing and sanitisers and avoided by memory-safe languages. More about Use after free.
Is CVE-2015-1421 being exploited?
There is no known exploitation of CVE-2015-1421 in the wild and no public exploit code.
Other vulnerabilities in Canonical Ubuntu Linux
Sources
Also known as DEBIAN-CVE-2015-1421, GHSA-76xf-x995-63r2, RHSA-2015:1030, SUSE-SU-2015:0832-1, UBUNTU-CVE-2015-1421.