RHSA-2015:1583Medium

Red Hat Security Advisory: kernel security and bug fix update

Published
August 11, 2015
Last Modified
November 5, 2026

🔗 CVE IDs covered (1)

CVE-2015-3636 →

📋 Description

CVE-2015-3636 — kernel: ping sockets: use-after-free leading to local privilege escalation

🎯 Affected products104

  • Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5)
  • Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • Red Hat Enterprise Linux Server EUS (v. 6.5)
  • Red Hat Enterprise Linux Server Optional EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.s390x as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.src as a component of Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.src as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.src as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.src as a component of Red Hat Enterprise Linux Server Optional EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • kernel-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-abi-whitelists-0:2.6.32-431.61.2.el6.noarch as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • kernel-abi-whitelists-0:2.6.32-431.61.2.el6.noarch as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-bootwrapper-0:2.6.32-431.61.2.el6.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-0:2.6.32-431.61.2.el6.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-0:2.6.32-431.61.2.el6.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-0:2.6.32-431.61.2.el6.s390x as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • kernel-debug-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.i686 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.i686 as a component of Red Hat Enterprise Linux Server Optional EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.ppc64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.ppc64 as a component of Red Hat Enterprise Linux Server Optional EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.s390x as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.s390x as a component of Red Hat Enterprise Linux Server Optional EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux Compute Node Optional EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux HPC Node EUS (v. 6.5)
  • kernel-debug-debuginfo-0:2.6.32-431.61.2.el6.x86_64 as a component of Red Hat Enterprise Linux Server EUS (v. 6.5)
  • +74 more not shown

✅ Remediation

Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 Workaround: You can check whether ping socket functionality is enabled by examining the net.ipv4.ping_group_range sysctl value: ~]# sysctl net.ipv4.ping_group_range net.ipv4.ping_group_range = 1 0 "1 0" is the default value and disables the ping socket functionality even for root user. Any other value means that the ping socket functionality might be enabled for certain users on the system. To mitigate this vulnerability make sure that you either allow the functionality to trusted local users (groups) only or set the net.ipv4.ping_group_range sysctl to the default and disabled state: ~]# sysctl net.ipv4.ping_group_range="1 0" Please note that this might prevent some programs relying on this functionality from functioning properly.

🔗 References (4)