CVE-2015-1350 describes a denial-of-service vulnerability in the Linux kernel's VFS subsystem (versions 3.x), specifically affecting how extended privilege attributes are handled during setattr operations. This flaw allows local users to strip capabilities from programs like ping or Wireshark dumpcap through failed system call invocations, impacting various Linux distributions including Red Hat Enterprise Linux. With a CVSS score of 5.5 (Medium), this vulnerability has a low attack complexity and requires local access, but can lead to a high availability impact by rendering privileged programs unusable. There is no evidence of active exploitation, nor are there publicly available exploit modules in Metasploit, Nuclei, or ExploitDB. While it has received minimal community discussion, it is not listed on the CISA KEV catalog or any hot lists.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 3.0, <= 3.19.8CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
5.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:* | ||
6.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* | ||
7.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:* | ||
2.0CPE matchmatch criteria | cpe:2.3:o:redhat:enterprise_mrg:2.0:*:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.