CVE-2015-8962

HIGH

Linux Kernel < 3.2.85 - Double Free in SG_IO ioctl Detach

Title source: llm
STIX 2.1

Description

Double free vulnerability in the sg_common_write function in drivers/scsi/sg.c in the Linux kernel before 4.4 allows local users to gain privileges or cause a denial of service (memory corruption and system crash) by detaching a device during an SG_IO ioctl call.

References (4)

Core 4
Core References
Third Party Advisory x_refsource_confirm
https://source.android.com/security/bulletin/2016-11-01.html
Third Party Advisory, VDB Entry vdb-entry x_refsource_bid
http://www.securityfocus.com/bid/94187

Scores

CVSS v3 7.3
EPSS 0.0180
EPSS Percentile 75.7%
Attack Vector LOCAL
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-415
Status published
Products (1)
linux/linux_kernel < 3.2.85
Published Nov 16, 2016
Tracked Since Feb 18, 2026