1. Home
  2. Vulnerabilities
  3. CVE-2015-1350

CVE-2015-1350

CVSS v3.1 5.5 (Medium)
55% Progress
CVSS v2.0 2.1 (Low)
21% Progress
EPSS 0.04 % (5th)
0.04% Progress
Affected Products 3
Advisories 10
Info CVSS EPSS CAPEC Affected Configurations References Security Advisories Packages & Software OVAL Tools, Exploits & PoC Graph Web & Social Timeline

The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.

Weaknesses
CWE-552
Files or Directories Accessible to External Parties
CVE Status
PUBLISHED
CNA
MITRE
Published Date
2016-05-02 10:59:07
(8 years ago)
Updated Date
2021-07-15 19:16:09
(3 years ago)

Affected Products

Linux

Redhat

Configuration #1

    CPE23 From Up To
  Linux Kernel from 3.0 version and 3.19.8 and prior versions cpe:2.3:o:linux:linux_kernel >= 3.0 <= 3.19.8

Configuration #2

    CPE23 From Up To
  Redhat Enterprise Linux 5.0 cpe:2.3:o:redhat:enterprise_linux:5.0
  Redhat Enterprise Linux 6.0 cpe:2.3:o:redhat:enterprise_linux:6.0
  Redhat Enterprise Linux 7.0 cpe:2.3:o:redhat:enterprise_linux:7.0
  Redhat Enterprise Mrg 2.0 cpe:2.3:o:redhat:enterprise_mrg:2.0