The evm_verify_hmac function in security/integrity/evm/evm_main.c in the Linux kernel before 4.5 does not properly copy data, which makes it easier for local users to forge MAC values via a timing side-channel attack.
CVSS Details
- CVSS 3.1 Base Score: 5.5
- CVSS 3.0 Vector: (CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade linux | Jul 30, 2024 | Apr 27, 2016 |
| Huawei Euleros 2_0_sp5 | — | Upgrade kernelUpgrade kernel-headersUpgrade kernel-tools-libsUpgrade kernel-develUpgrade kernel-toolsUpgrade perfUpgrade python-perf | Feb 24, 2020 | Apr 27, 2016 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 11, 2016 |
| Ubuntu | — | Upgrade linux-image-3.13.0-85-genericUpgrade linux-image-3.16.0-69-powerpc64-smpUpgrade linux-image-3.13.0-85-powerpc64-smpUpgrade linux-image-3.19.0-58-powerpc64-smpUpgrade linux-image-4.2.0-35-genericUpgrade linux-image-3.19.0-58-powerpc-smpUpgrade linux-image-3.16.0-69-lowlatencyUpgrade linux-image-3.13.0-85-powerpc64-embUpgrade linux-image-3.19.0-58-powerpc-e500mcUpgrade linux-image-3.16.0-69-genericUpgrade linux-image-3.13.0-85-powerpc-e500Upgrade linux-image-4.2.0-1028-raspi2Upgrade linux-image-3.16.0-69-powerpc-e500mcUpgrade linux-image-3.16.0-69-powerpc-smpUpgrade linux-image-4.2.0-35-powerpc-smpUpgrade linux-image-3.16.0-69-powerpc64-embUpgrade linux-image-4.2.0-35-powerpc-e500mcUpgrade linux-image-3.16.0-69-generic-lpaeUpgrade linux-image-4.2.0-35-powerpc64-embUpgrade linux-image-4.2.0-35-lowlatencyUpgrade linux-image-3.13.0-85-powerpc-smpUpgrade linux-image-3.19.0-58-lowlatencyUpgrade linux-image-3.19.0-58-generic-lpaeUpgrade linux-image-3.13.0-85-powerpc-e500mcUpgrade linux-image-4.2.0-35-generic-lpaeUpgrade linux-image-3.19.0-58-powerpc64-embUpgrade linux-image-3.13.0-85-lowlatencyUpgrade linux-image-4.2.0-35-powerpc64-smpUpgrade linux-image-3.19.0-58-genericUpgrade linux-image-3.13.0-85-generic-lpae | Apr 11, 2016 | Apr 11, 2016 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub