What’s Vulnerable › Vulnerabilities

CVE-2015-2666

• Severity: medium (CVSS 6.9 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-05-27 · updated 2026-06-17
• Weakness: CWE-119

Description

Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

Affected products

• Fedoraproject Fedora: 21
• Linux kernel: from 3.9 before 3.10.83; from 3.11 before 3.12.40; from 3.13 before 3.14.47; from 3.15 before 3.16.35; from 3.17 before 3.18.19 — fixed in 3.10.83, 3.12.40, 3.14.47, 3.16.35, 3.18.19

How to fix

Upgrade to a fixed version: Linux kernel 3.10.83, 3.12.40, 3.14.47, 3.16.35. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153329.html
• http://rhn.redhat.com/errata/RHSA-2015-1534.html
• http://www.openwall.com/lists/oss-security/2015/03/20/18
• http://www.securitytracker.com/id/1032414
• https://bugzilla.redhat.com/show_bug.cgi?id=1204722
• https://github.com/torvalds/linux/commit/f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4
• http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153329.html
• http://rhn.redhat.com/errata/RHSA-2015-1534.html
• http://www.openwall.com/lists/oss-security/2015/03/20/18
• http://www.securitytracker.com/id/1032414

Get alerted when CVE-2015-2666 or the next vulnerability affects your stack