CVE-2015-3290
Higharch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
CVSS 2.0 score
7.2
AV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness type
CWE-264CVE-2015-3290 is a Permissions, Privileges and Access Control vulnerability
What is Permissions, Privileges and Access Control?
Weaknesses in this category are related to the management of permissions, privileges, and access controls. Learn more on MITRE CWE
References
The following references provide additional information about CVE-2015-3290 including vendor advisories, patch commits, exploit details, and third-party analysis. Links are sourced from the NIST NVD database.
-
Third Party Advisory VDB Entry
-
Debian Securityhttp://www.debian.org/security/2015/dsa-3313Third Party Advisory VDB Entry
-
Vendor Advisory
-
Mailing List
-
Mailing List
-
Securityfocushttp://www.securityfocus.com/bid/76004Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2687-1Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2688-1Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2689-1Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2690-1Third Party Advisory VDB Entry
-
Ubuntu Securityhttp://www.ubuntu.com/usn/USN-2691-1Third Party Advisory VDB Entry
-
Issue Tracking
-
Exploit-DBhttps://www.exploit-db.com/exploits/37722/Third Party Advisory VDB Entry
-
PatchKernel patch commithttp://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a
-
PatchKernel patch commithttps://github.com/torvalds/linux/commit/9b6e6a8334d56354853f9c255d1395c2ba570e0a
Frequently asked questions
-
What is CVE-2015-3290?
CVE-2015-3290 is a High severity Linux kernel vulnerability with a CVSS score of 7.2 out of 10 , classified as a Permissions, Privileges and Access Control flaw (CWE-264) . CVE-2015-3290 has not been confirmed as actively exploited and is not listed in the CISA KEV catalog.
-
What is the CVSS score for CVE-2015-3290?
CVE-2015-3290 has a CVSS score of 7.2 out of 10, rated High severity (CVSS 2.0). The vector string is
AV:L/AC:L/Au:N/C:C/I:C/A:C. -
Is there a patch available for CVE-2015-3290?
No patch is currently available for CVE-2015-3290. Monitor the NIST NVD and your Linux distribution's security advisories for updates.
-
Is CVE-2015-3290 actively exploited?
No — CVE-2015-3290 has not been confirmed as actively exploited. It is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog.
-
What is Permissions, Privileges and Access Control (CWE-264)?
Weaknesses in this category are related to the management of permissions, privileges, and access controls. View CWE-264 on MITRE CWE →