CVE-2015-3290

Published: 23 July 2015

arch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.

From the Ubuntu Security Team

Andy Lutomirski discovered a flaw in the Linux kernel's handling of nested NMIs (non-maskable interrupts). An unprivileged local user could exploit this flaw to cause a denial of service (system crash) or potentially escalate their privileges.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.10 and earlier preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Per oss-security, affects 3.13 and newer

precise_linux 3.2-based kernels set to "not-affected (code not present)" per
oss-security post

Status

References

• https://ubuntu.com/security/notices/USN-2687-1
• https://ubuntu.com/security/notices/USN-2688-1
• https://ubuntu.com/security/notices/USN-2689-1
• https://ubuntu.com/security/notices/USN-2690-1
• https://ubuntu.com/security/notices/USN-2691-1
• https://ubuntu.com/security/notices/USN-2700-1
• https://ubuntu.com/security/notices/USN-2701-1
• http://www.openwall.com/lists/oss-security/2015/07/22/7
• https://www.cve.org/CVERecord?id=CVE-2015-3290
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1477026