CVE-2015-5231

Severity: medium (CVSS 5.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.4% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2016-06-07 · updated 2026-06-17
Weakness: CWE-200

Description

The service daemon in CRIU does not properly restrict access to non-dumpable processes, which allows local users to obtain sensitive information via (1) process dumps or (2) ptrace access.

Affected products

Criu Checkpoint/Restore In Userspace: all versions
Opensuse: 13.2

References

http://lists.opensuse.org/opensuse-updates/2015-09/msg00030.html
http://www.openwall.com/lists/oss-security/2015/08/25/5
https://bugzilla.redhat.com/show_bug.cgi?id=1256728
https://lists.openvz.org/pipermail/criu/2015-August/021847.html
http://lists.opensuse.org/opensuse-updates/2015-09/msg00030.html
http://www.openwall.com/lists/oss-security/2015/08/25/5
https://bugzilla.redhat.com/show_bug.cgi?id=1256728
https://lists.openvz.org/pipermail/criu/2015-August/021847.html

Get alerted when CVE-2015-5231 or the next vulnerability affects your stack