CVE-2015-5156

What it actually does

The virtnet_probe function in the Linux kernel's virtio_net driver attempts to support the FRAGLIST feature without allocating sufficient memory, allowing a guest OS user to trigger a buffer overflow and subsequent memory corruption via a sequence of crafted fragmented network packets, resulting in denial of service.

Why it matters to the business

Virtualized Linux environments can experience sudden host kernel crashes or instability when a compromised or malicious guest sends malformed traffic, leading to downtime for dependent services and workloads.

How an attack unfolds

An attacker with control of a guest virtual machine crafts a sequence of fragmented packets that exploit the missing memory allocation check in the host's virtio network driver, causing a buffer overflow that corrupts kernel memory and crashes the system.

How to fix it

Upgrade the Linux kernel to version 4.2 or later where the virtnet_probe function properly handles memory allocation for the FRAGLIST feature; apply the fix from the upstream commit that addresses improper allocation in drivers/net/virtio_net.c.

How to confirm the fix worked

Verify the running kernel version is 4.2 or newer; inspect the virtio_net.c source for the corrected memory allocation logic in virtnet_probe; test by attempting to send fragmented packets from a guest and confirm no crash occurs.

Typical attack path

1. Obtain access to a guest virtual machine on a vulnerable host
2. Generate a crafted sequence of fragmented network packets
3. Transmit the packets through the virtio network interface to trigger the flaw
4. Cause buffer overflow and kernel memory corruption leading to denial of service

How to detect it

Review kernel logs for oops or panic entries referencing virtio_net or virtnet_probe around the time of suspected activity; examine network traffic captures from guests for unusual fragmented packet sequences; check system stability logs for sudden host reboots without other explanation.

What your security team should do

• Prioritize kernel upgrades on all hosts using virtio networking for virtual machines
• Isolate or restrict network access from untrusted guest VMs until patched
• Monitor for kernel oops or panic logs related to virtio_net after any suspected exposure