CVE-2015-2925

Quick assessment

Copy summary Copy citation

Affected

n/a n/a

Exploitation

Public or AI PoC available; prioritize validation

Recommended action

Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4 implementation是其中的一个分布式文件系统协议。 Linux kernel 4.2.3及之前版本的fs/dcache.c文件中的‘prepend_path’函数存在安全漏洞，该漏洞源于程序没有正确处理绑定挂载中的重命名操作。本地攻击者可通过重命名目录利用该漏洞绕过既定的容器保护机制。

CVE-2015-2925 affects n/a n/a. Public or AI PoC available; prioritize validation. Linux kernel是美国Linux基金会发布的开源操作系统Linux所使用的内核。NFSv4 implementation是其中的一个分布式文件系统协议。 Linux kernel 4.2.3及之前版本的fs/dcache.c文件中的‘prepend_path’函数存在安全漏洞，该漏洞源于程序没有正确处理绑定挂载中的重命名操作。本地攻击者可通过重命名目 CVE-2015-2925 vulnerability details, Shenlong CVE Platform, https://cve.imfht.com/detail/CVE-2015-2925

I. Basic Information for CVE-2015-2925

Affected Products

II. Public POCs for CVE-2015-2925

III. Intelligence Information for CVE-2015-2925

Patches & Fixes for CVE-2015-2925 (4)

• https://github.com/torvalds/linux/commit/397d425dc26da728396e66d392d5dcb8dac30c37 x_refsource_CONFIRM
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=cde93be45a8a90d8c264c776fab63487b5038a65 x_refsource_CONFIRM
• http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=397d425dc26da728396e66d392d5dcb8dac30c37 x_refsource_CONFIRM
• https://github.com/torvalds/linux/commit/cde93be45a8a90d8c264c776fab63487b5038a65 x_refsource_CONFIRM

Vendor Advisories for CVE-2015-2925 (11)

• https://bugzilla.redhat.com/show_bug.cgi?id=1209373 x_refsource_CONFIRM
• https://bugzilla.redhat.com/show_bug.cgi?id=1209367 x_refsource_CONFIRM
• http://www.securityfocus.com/bid/73926 vdb-entry x_refsource_BID
• http://www.debian.org/security/2015/dsa-3364 vendor-advisory x_refsource_DEBIAN
• http://www.debian.org/security/2015/dsa-3372 vendor-advisory x_refsource_DEBIAN
• http://www.ubuntu.com/usn/USN-2795-1 vendor-advisory x_refsource_UBUNTU
• 🔗 USN-2799-1: Linux kernel vulnerabilities | Ubuntu security notices | Ubuntu Read full article vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-2792-1 vendor-advisory x_refsource_UBUNTU
• http://www.ubuntu.com/usn/USN-2794-1 vendor-advisory x_refsource_UBUNTU
• http://rhn.redhat.com/errata/RHSA-2016-0068.html vendor-advisory x_refsource_REDHAT
• http://rhn.redhat.com/errata/RHSA-2015-2636.html vendor-advisory x_refsource_REDHAT

Mailing List Discussions for CVE-2015-2925 (12)

• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00034.html vendor-advisory x_refsource_SUSE
• openSUSE check vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00019.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00022.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00007.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00009.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00018.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00017.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00020.html vendor-advisory x_refsource_SUSE
• http://lists.opensuse.org/opensuse-security-announce/2016-02/msg00021.html vendor-advisory x_refsource_SUSE
• http://www.openwall.com/lists/oss-security/2015/04/04/4 mailing-list x_refsource_MLIST

Other References for CVE-2015-2925 (6)

• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html x_refsource_CONFIRM
• http://pkgs.fedoraproject.org/cgit/kernel.git/commit/?h=f22&id=520b64102de2f184036024b2a53de2b67463bd78 x_refsource_CONFIRM
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html x_refsource_CONFIRM
• http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.2.4 x_refsource_CONFIRM
• http://permalink.gmane.org/gmane.linux.kernel.containers/29177 mailing-list x_refsource_MLIST
• http://permalink.gmane.org/gmane.linux.kernel.containers/29173 mailing-list x_refsource_MLIST

• https://www.cve.org/CVERecord?id=CVE-2015-2925

Same Patch Batch · n/a · 2015-11-16 · 13 CVEs total

IV. Related Vulnerabilities

V. Comments for CVE-2015-2925