CVE-2015-3290

What it actually does

The flaw allows local privilege escalation on x86_64 systems by exploiting improper espfix64 handling during nested NMI processing in the kernel entry code, enabling an attacker to execute code with elevated privileges within a narrow instruction window.

Why it matters to the business

Attackers with existing local access can obtain full administrative control over affected Linux systems, leading to data theft, persistence, or further lateral movement within an environment.

How an attack unfolds

An attacker with local user access triggers a non-maskable interrupt during a specific instruction sequence in the NMI handler, bypassing normal privilege checks and allowing arbitrary code execution at ring 0.

How to fix it

Upgrade the Linux kernel to version 4.1.6 or later on all x86_64 systems; apply the fix from the upstream commit that corrects espfix64 handling during nested NMI processing.

How to confirm the fix worked

Verify the running kernel version is 4.1.6 or newer using uname -r; confirm the espfix64 logic in entry_64.S no longer contains the vulnerable path by inspecting the patched source or changelog.

Typical attack path

1. Obtain unprivileged local shell access on a vulnerable x86_64 Linux host
2. Execute a crafted program that forces nested NMIs within the vulnerable instruction window
3. Overwrite kernel structures or redirect execution to gain root privileges
4. Install persistence mechanisms or exfiltrate data from the now-compromised system

How to detect it

Look in system logs for unusual NMI-related kernel messages or unexpected root escalations; examine audit logs for processes that suddenly change user ID shortly after NMI events; review any custom exploit artifacts or modified kernel modules post-escalation.

What your security team should do

• Immediately patch all x86_64 Linux systems to kernel 4.1.6 or later
• Restrict local user accounts and monitor for unexpected privilege changes
• Review and harden NMI-related kernel configurations where possible
• Include this class of entry-code flaws in future kernel update testing