CVE-2015-3636
Linux kernel <4.0.3 - Use After Free
Title source: llmDescription
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
Exploits (9)
nomisec
WORKING POC
45 stars
by android-rooting-tools · poc
https://github.com/android-rooting-tools/libpingpong_exploit
github
WORKING POC
38 stars
by Miracle963 · pythonpoc
https://github.com/Miracle963/bluetooth-cve/tree/master/littl_tools/android_root/cve-2015-3636
github
WORKING POC
31 stars
by OpenSISE · cpoc
https://github.com/OpenSISE/CVE_PoC_Collect/tree/master/EoP/android/CVE-2015-3636
References (28)
... and 8 more
Scores
EPSS
0.0209
EPSS Percentile
83.8%
Classification
Status
draft
Affected Products (4)
linux/linux_kernel
< 4.0.2
debian/debian_linux
redhat/enterprise_linux
canonical/ubuntu_linux
Timeline
Published
Aug 06, 2015
Tracked Since
Feb 18, 2026