CVE-2015-2666

MediumCVSS 6.9/10Last modified Jun 17, 2026

Description

Stack-based buffer overflow in the get_matching_model_microcode function in arch/x86/kernel/cpu/microcode/intel_early.c in the Linux kernel before 4.0 allows context-dependent attackers to gain privileges by constructing a crafted microcode header and leveraging root privileges for write access to the initrd.

Metrics

CVSS 2.0 6.9/10AV:L/AC:M/Au:N/C:C/I:C/A:C

Weakness enumeration

CWE-119

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153329.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1534.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/20/18Mailing List
http://www.securitytracker.com/id/1032414Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1204722Issue Tracking
https://github.com/torvalds/linux/commit/f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4Patch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4Broken Link
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/153329.htmlThird Party Advisory
http://rhn.redhat.com/errata/RHSA-2015-1534.htmlThird Party Advisory
http://www.openwall.com/lists/oss-security/2015/03/20/18Mailing List
http://www.securitytracker.com/id/1032414Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1204722Issue Tracking
https://github.com/torvalds/linux/commit/f84598bd7c851f8b0bf8cd0d7c3be0d73c432ff4Patch

Timeline

Published: May 27, 2015
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2015

CVE-2015-26677.2Untrusted search path vulnerability in GNS3 1.2.3 allows local users to gain privileges via a Trojan horse uuid.dll in an unspecified direct CVE-2015-26685.0ClamAV before 0.98.7 allows remote attackers to cause a denial of service (infinite loop) via a crafted xz archive file.CVE-2015-26725.5The xsave/xrstor implementation in arch/x86/include/asm/xsave.h in the Linux kernel before 3.19.2 creates certain .altinstr_replacement poin CVE-2015-26738.8The ec_ajax_update_option and ec_ajax_clear_all_taxrates functions in inc/admin/admin_ajax_functions.php in the WP EasyCart plugin 1.1.30 th CVE-2015-26745.9Restkit allows man-in-the-middle attackers to spoof TLS servers by leveraging use of the ssl.wrap_socket function in Python with the default CVE-2015-26757.5The OAuth implementation in librest before 0.7.93 incorrectly truncates the pointer returned by the rest_proxy_call_get_url function, which CVE-2015-26766.8Cross-site request forgery (CSRF) vulnerability in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allows remote attackers to hija CVE-2015-26773.5Multiple cross-site scripting (XSS) vulnerabilities in ocPortal before 9.0.17 allow remote authenticated users to inject arbitrary web scrip CVE-2015-26784.3Multiple cross-site scripting (XSS) vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to inject arbitrary web scrip CVE-2015-26797.5Multiple SQL injection vulnerabilities in MetalGenix GeniXCMS before 0.0.2 allow remote attackers to execute arbitrary SQL commands via the CVE-2015-26806.8Cross-site request forgery (CSRF) vulnerability in MetalGenix GeniXCMS before 0.0.2 allows remote attackers to hijack the authentication of CVE-2015-26814.3Multiple cross-site scripting (XSS) vulnerabilities in the ASUS RT-G32 routers with firmware 2.0.2.6 and 2.0.3.2 allow remote attackers to i