CVE-2015-3636
Linux kernel <4.0.3 - Use After Free
Title source: llmDescription
The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.
Exploits (9)
nomisec
WORKING POC
45 stars
by android-rooting-tools · poc
https://github.com/android-rooting-tools/libpingpong_exploit
github
WORKING POC
38 stars
by Miracle963 · pythonpoc
https://github.com/Miracle963/bluetooth-cve/tree/master/littl_tools/android_root/cve-2015-3636
github
WORKING POC
31 stars
by OpenSISE · cpoc
https://github.com/OpenSISE/CVE_PoC_Collect/tree/master/EoP/android/CVE-2015-3636
References (28)
... and 8 more
Scores
EPSS
0.0330
EPSS Percentile
87.3%
Details
Status
published
Products (4)
canonical/ubuntu_linux
12.04
debian/debian_linux
7.0
linux/linux_kernel
< 4.0.2
redhat/enterprise_linux
6.0
Published
Aug 06, 2015
Tracked Since
Feb 18, 2026