CVE-2015-1421 is a critical use-after-free vulnerability in the Linux kernel's SCTP implementation (sctp_assoc_update function in net/sctp/associola.c), affecting versions before 3.18.8, including various Canonical and Debian Linux distributions. This flaw allows remote attackers to trigger a denial of service (slab corruption and system panic) or potentially achieve other unspecified impacts by exploiting an INIT collision that mishandles shared-key data. With a CVSS score of 10.0 (AV:N/AC:L/Au:N/C:C/I:C/A:C), it represents a severe risk due to its network-based attack vector, low attack complexity, and complete compromise potential for confidentiality, integrity, and availability. Despite its high severity, there is no known active exploitation, publicly available exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage surrounding this vulnerability.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.24, < 3.2.67CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.3, < 3.4.107CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.5, < 3.10.70CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.11, < 3.12.38CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.13, < 3.14.34CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:L/Au:N/C:C/I:C/A:C
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.