CVE-2015-8324 Null dereference in n/a
A local attacker with physical access can cause a system crash via a crafted USB device due to a NULL pointer dereference in the ext4 filesystem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-8324?
CVE-2015-8324 is a medium-severity vulnerability in Linux kernel, published on 2 May 2016. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The ext4 implementation in the Linux kernel before 2.6.34 does not properly track the initialization of certain data structures, which allows physically proximate attackers to cause a denial of service (NULL pointer dereference and panic) via a crafted USB device, related to the ext4_fill_super function.
Which versions are affected by CVE-2015-8324?
It affects 1 product.
Products include Linux kernel.
How do I fix CVE-2015-8324?
Apply the vendor's patch.
Is CVE-2015-8324 being exploited?
There is no known exploitation of CVE-2015-8324 in the wild and no public exploit code.
Other vulnerabilities in Linux kernel
Sources
Also known as DEBIAN-CVE-2015-8324, GHSA-f6x7-vppw-cjgq.