CVE-2015-5283
linux linux kernel: no CVSS score yet. EPSS 0.5% chance of exploitation in the next 30 days.
The sctp_init function in net/sctp/protocol.c in the Linux kernel before 4.2.3 has an incorrect sequence of protocol-initialization steps, which allows local users to cause a denial of service (panic or memory corruption) by creating SCTP sockets before all of the steps have finished.
- EPSS
- 0.5% chance of exploitation in the next 30 days; higher than 45% of CVEs (scores of 2026-10-31)
- CWE
- CWE-119
- Published
- Modified
- Record from
- the NVD, synced
Affected
- linux:linux_kernel
References
- http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=8e2d61e0aed2b7c4ecb35844fe07e0b2b762dee4
- http://lists.opensuse.org/opensuse-security-announce/2015-10/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-12/msg00005.html
- http://patchwork.ozlabs.org/patch/515996/
- http://www.debian.org/security/2015/dsa-3372