VulnerabilityModified

CVE-2015-8950

arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by…

MEDIUM 5.5EPSS 1.46%

Does this matter?

Lower severity and a low EPSS score (1.46%). Track it; it rarely justifies an emergency change on its own.

Description

CVSS 3.0: 5.5 MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS: 1.46% probability · 72th percentile
CISA KEV: Not listed
Weakness: CWE-200
Affected: linux/linux kernel
Source: security@android.com

References

http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5Issue Tracking, Patch
http://source.android.com/security/bulletin/2016-10-01.htmlVendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3Release Notes
http://www.securityfocus.com/bid/93318
https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5Issue Tracking, Patch
https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8Issue Tracking, Patch
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5Issue Tracking, Patch
http://source.android.com/security/bulletin/2016-10-01.htmlVendor Advisory
http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3Release Notes
http://www.securityfocus.com/bid/93318
https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5Issue Tracking, Patch
https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8Issue Tracking, Patch

Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.