CVE-2015-3643

Severity: high (CVSS 7.8 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 1.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2017-09-28 · updated 2026-06-17
Weakness: CWE-264

Description

usb-creator before 0.2.38.3ubuntu0.1 on Ubuntu 12.04 LTS, before 0.2.56.3ubuntu0.1 on Ubuntu 14.04 LTS, before 0.2.62ubuntu0.3 on Ubuntu 14.10, and before 0.2.67ubuntu0.1 on Ubuntu 15.04 allows local users to gain privileges by leveraging a missing call check_polkit for the KVMTest method.

Affected products

Usb-Creator Project Usb-Creator: through 0.2.38.3; through 0.2.56.3; through 0.2.62ubuntu0.2; through 0.2.67

References

http://www.openwall.com/lists/oss-security/2015/04/22/12
http://www.openwall.com/lists/oss-security/2015/05/04/3
http://www.securityfocus.com/bid/74304
https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470
https://usn.ubuntu.com/usn/usn-2576-1/
https://usn.ubuntu.com/usn/usn-2576-2/
https://www.exploit-db.com/exploits/36820/
http://www.openwall.com/lists/oss-security/2015/04/22/12
http://www.openwall.com/lists/oss-security/2015/05/04/3
http://www.securityfocus.com/bid/74304
https://bazaar.launchpad.net/~usb-creator-hackers/usb-creator/trunk/revision/470
https://usn.ubuntu.com/usn/usn-2576-1/

Get alerted when CVE-2015-3643 or the next vulnerability affects your stack