CVE-2015-6640 Privilege escalation in n/a
A local attacker can exploit a kernel flaw in Android to gain privileges or cause a denial of service via a crafted application.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2015-6640?
CVE-2015-6640 is a high-severity vulnerability in Google Android, published on 6 Jan 2016. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
The prctl_set_vma_anon_name function in kernel/sys.c in Android before 5.1.1 LMY49F and 6.0 before 2016-01-01 does not ensure that only one vma is accessed in a certain update action, which allows attackers to gain privileges or cause a denial of service (vma list corruption) via a crafted application, aka internal bug 20017123.
Weakness: CWE-264
Which versions are affected by CVE-2015-6640?
It affects 1 product.
Products include Google Android.
How do I fix CVE-2015-6640?
No fix has been published for CVE-2015-6640 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-6640 being exploited?
There is no known exploitation of CVE-2015-6640 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Google Android
Sources
Also known as GHSA-82j5-hvq2-xqxg, UBUNTU-CVE-2015-6640.