CVE

Id
80154  
CVE No.
CVE-2015-2877  
Status
Candidate  
Description
** DISPUTED ** Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities.  
Phase
Assigned (20150403)  
Votes
None (candidate not yet proposed)  
Comments
 

Actions

Related CVE References

Id CVE Id CVE No. Reference Actions
725760 80154 CVE-2015-2877 MISC:http://www.antoniobarresi.com/files/cain_advisory.txt  View
725761 80154 CVE-2015-2877 MISC:https://bugzilla.redhat.com/show_bug.cgi?id=1252096  View
725762 80154 CVE-2015-2877 MISC:https://www.kb.cert.org/vuls/id/BGAR-A2CNKG  View
725763 80154 CVE-2015-2877 MISC:https://www.kb.cert.org/vuls/id/BLUU-9ZAHZH  View
725764 80154 CVE-2015-2877 MISC:https://www.usenix.org/system/files/conference/woot15/woot15-paper-barresi.pdf  View
725765 80154 CVE-2015-2877 CERT-VN:VU#935424  View
725766 80154 CVE-2015-2877 URL:http://www.kb.cert.org/vuls/id/935424  View
725767 80154 CVE-2015-2877 BID:76256  View

Related JVN