{
  "threat_severity" : "Low",
  "public_date" : "2014-11-21T00:00:00Z",
  "bugzilla" : {
    "description" : "kernel: denial of service in notify_change for filesystem xattrs",
    "id" : "1185139",
    "url" : "https://bugzilla.redhat.com/show_bug.cgi?id=1185139"
  },
  "cvss" : {
    "cvss_base_score" : "3.2",
    "cvss_scoring_vector" : "AV:L/AC:L/Au:S/C:N/I:P/A:P",
    "status" : "draft"
  },
  "cwe" : "CWE-552",
  "details" : [ "The VFS subsystem in the Linux kernel 3.x provides an incomplete set of requirements for setattr operations that underspecifies removing extended privilege attributes, which allows local users to cause a denial of service (capability stripping) via a failed invocation of a system call, as demonstrated by using chown to remove a capability from the ping or Wireshark dumpcap program.", "It was found that a regular user could remove xattr permissions on files by using the chown or write system calls. A local attacker could use this flaw to deny elevated permissions from valid users, services, or applications, potentially resulting in a denial of service." ],
  "statement" : "This issue affects the versions of the Linux kernel as shipped with Red Hat Enterprise Linux 6, 7 and MRG 2.\nThis has been rated as having Low security impact and is not currently planned to be addressed in future updates. For additional information, refer to the Red Hat Enterprise Linux Life Cycle: https://access.redhat.com/support/policy/updates/errata",
  "package_state" : [ {
    "product_name" : "Red Hat Enterprise Linux 5",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:5"
  }, {
    "product_name" : "Red Hat Enterprise Linux 6",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:6"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "kernel",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise Linux 7",
    "fix_state" : "Will not fix",
    "package_name" : "kernel-rt",
    "cpe" : "cpe:/o:redhat:enterprise_linux:7"
  }, {
    "product_name" : "Red Hat Enterprise MRG 2",
    "fix_state" : "Will not fix",
    "package_name" : "realtime-kernel",
    "cpe" : "cpe:/a:redhat:enterprise_mrg:2"
  } ],
  "references" : [ "https://www.cve.org/CVERecord?id=CVE-2015-1350\nhttps://nvd.nist.gov/vuln/detail/CVE-2015-1350" ],
  "name" : "CVE-2015-1350",
  "csaw" : false
}