Vulnerability Database

299,686

Total vulnerabilities in the database

CVE-2015-2686

net/socket.c in the Linux kernel 3.19 before 3.19.3 does not validate certain range data for (1) sendto and (2) recvfrom system calls, which allows local users to gain privileges by leveraging a subsystem that uses the copy_from_iter function in the iov_iter interface, as demonstrated by the Bluetooth subsystem.

  • Published: May 2, 2016
  • Updated: Apr 13, 2023
  • CVE: CVE-2015-2686
  • Severity: High
  • Exploit:

CVSS v3:

  • Severity: High
  • Score: 7.8
  • AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS v2:

  • Severity: High
  • Score: 7.2
  • AV:L/AC:L/Au:N/C:C/I:C/A:C

CWEs:

Software From Fixed in
linux / linux_kernel 3.19 3.19.x
linux / linux_kernel 3.19.1 3.19.1.x
linux / linux_kernel 3.19.2 3.19.2.x