CVE-2015-3290

NameCVE-2015-3290
Descriptionarch/x86/entry/entry_64.S in the Linux kernel before 4.1.6 on the x86_64 platform improperly relies on espfix64 during nested NMI processing, which allows local users to gain privileges by triggering an NMI within a certain instruction window.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SuSE, Mageia, GitHub code/issues, web search, more)
ReferencesDSA-3313-1
NVD severityhigh (attack range: local)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
linux (PTS)wheezy3.2.78-1fixed
wheezy (security)3.2.93-1fixed
jessie3.16.43-2+deb8u2fixed
jessie (security)3.16.43-2+deb8u5fixed
stretch4.9.51-1fixed
stretch (security)4.9.30-2+deb9u5fixed
buster, sid4.13.4-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
linuxsource(unstable)4.0.8-2high
linuxsourcejessie3.16.7-ckt11-1+deb8u2highDSA-3313-1
linuxsourcewheezy(not affected)
linux-2.6source(unstable)(not affected)

Notes

[wheezy] - linux <not-affected> (Introduced in 3.13)
- linux-2.6 <not-affected> (Introduced in 3.13)
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9d05041679904b12c12421cbcf9cb5f4860a8d7b (prerequisite)
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0e181bb58143cb4a2e8f01c281b0816cd0e4798e (prerequisite)
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=9b6e6a8334d56354853f9c255d1395c2ba570e0a

Search for package or bug name: Reporting problems