CVE-2015-3636

What it actually does

Use-after-free in ping_unhash due to uninitialized list structure during socket unhash for IPPROTO_ICMP/IPPROTO_ICMPV6, enabling local privilege escalation or kernel crash.

Why it matters to the business

Local attackers on unpatched systems can crash hosts or escalate privileges, risking service disruption and unauthorized access on exposed Linux servers; high ecosystem prevalence means many legacy deployments remain affected despite the age of the flaw.

How an attack unfolds

A local attacker creates a SOCK_DGRAM ICMP socket, performs a disconnect, then a connect to trigger the flawed unhash path; this leads to use-after-free for code execution or denial of service.

How to fix it

Upgrade Linux kernel to version 4.0.3 or later; apply vendor backports for affected distributions such as Debian, Red Hat Enterprise Linux, and Ubuntu; reboot after update.

How to confirm the fix worked

Verify running kernel version is 4.0.3 or newer; confirm absence of vulnerable ping.c code paths via source inspection or vendor advisories.

Typical attack path

1. Obtain local shell access on target Linux host
2. Invoke socket system call for IPPROTO_ICMP or IPPROTO_ICMPV6
3. Issue disconnect followed by connect on the socket
4. Trigger use-after-free to corrupt kernel structures
5. Escalate privileges or crash the system

How to detect it

Review kernel logs for use-after-free oops or panic messages referencing ping_unhash; correlate with local user socket activity in auditd or strace artifacts on suspected hosts.

What your security team should do

• Prioritize kernel upgrades on internet-facing or multi-tenant systems
• Enforce least-privilege local accounts to limit exploit surface
• Monitor for kernel oops/panic logs indicating potential exploitation attempts
• Retire or isolate end-of-life distributions lacking backports