CVE-2015-3636

Linux kernel <4.0.3 - Use After Free

Title source: llm

Description

The ping_unhash function in net/ipv4/ping.c in the Linux kernel before 4.0.3 does not initialize a certain list data structure during an unhash operation, which allows local users to gain privileges or cause a denial of service (use-after-free and system crash) by leveraging the ability to make a SOCK_DGRAM socket system call for the IPPROTO_ICMP or IPPROTO_ICMPV6 protocol, and then making a connect system call after a disconnect.

Exploits (9)

nomisec WORKING POC 135 stars
by fi01 · poc
https://github.com/fi01/CVE-2015-3636
nomisec WORKING POC 45 stars
by android-rooting-tools · poc
https://github.com/android-rooting-tools/libpingpong_exploit
github WORKING POC 38 stars
by Miracle963 · pythonpoc
https://github.com/Miracle963/bluetooth-cve/tree/master/littl_tools/android_root/cve-2015-3636
github WORKING POC 31 stars
by OpenSISE · cpoc
https://github.com/OpenSISE/CVE_PoC_Collect/tree/master/EoP/android/CVE-2015-3636
nomisec WORKING POC 18 stars
by a7vinx · poc
https://github.com/a7vinx/CVE-2015-3636
nomisec WORKING POC 4 stars
by betalphafai · poc
https://github.com/betalphafai/cve-2015-3636_crash
nomisec WORKING POC 3 stars
by askk · poc
https://github.com/askk/libping_unhash_exploit_POC
nomisec WORKING POC 1 stars
by debugfan · poc
https://github.com/debugfan/rattle_root
nomisec STUB
by ludongxu · poc
https://github.com/ludongxu/cve-2015-3636

References (28)

... and 8 more

Scores

EPSS 0.0209
EPSS Percentile 83.8%

Classification

Status draft

Affected Products (4)

linux/linux_kernel < 4.0.2
debian/debian_linux
redhat/enterprise_linux
canonical/ubuntu_linux

Timeline

Published Aug 06, 2015
Tracked Since Feb 18, 2026