Low severity3.3NVD Advisory· Published Mar 3, 2017· Updated Jun 17, 2026
CVE-2015-2877
CVE-2015-2877
Description
Kernel Samepage Merging (KSM) in the Linux kernel 2.6.32 through 4.x does not prevent use of a write-timing side channel, which allows guest OS users to defeat the ASLR protection mechanism on other guest OS instances via a Cross-VM ASL INtrospection (CAIN) attack. NOTE: the vendor states "Basically if you care about this attack vector, disable deduplication." Share-until-written approaches for memory conservation among mutually untrusting tenants are inherently detectable for information disclosure, and can be classified as potentially misunderstood behaviors rather than vulnerabilities
AI Insight
LLM-synthesized narrative grounded in this CVE's description and references.
Affected products
7cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*+ 3 more
- cpe:2.3:o:redhat:enterprise_linux:4.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:5.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*
- cpe:2.3:o:redhat:enterprise_linux:7.0:*:*:*:*:*:*:*
Patches
Vulnerability mechanics
References
7- www.antoniobarresi.com/files/cain_advisory.txtnvdTechnical DescriptionThird Party Advisory
- www.kb.cert.org/vuls/id/935424nvdThird Party AdvisoryUS Government Resource
- www.securityfocus.com/bid/76256nvdThird Party AdvisoryVDB Entry
- bugzilla.redhat.com/show_bug.cginvdIssue TrackingThird Party Advisory
- www.kb.cert.org/vuls/id/BGAR-A2CNKGnvdThird Party AdvisoryUS Government Resource
- www.kb.cert.org/vuls/id/BLUU-9ZAHZHnvdThird Party AdvisoryUS Government Resource
- www.usenix.org/system/files/conference/woot15/woot15-paper-barresi.pdfnvdTechnical DescriptionThird Party Advisory
News mentions
0No linked articles in our index yet.