{"api_version":"1","generated_at":"2026-07-23T05:43:53+00:00","cve":"CVE-2015-8950","urls":{"html":"https://cve.report/CVE-2015-8950","api":"https://cve.report/api/cve/CVE-2015-8950.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2015-8950","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2015-8950"},"summary":{"title":"CVE-2015-8950","description":"arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.","state":"PUBLISHED","assigner":"google_android","published_at":"2016-10-10 10:59:01","updated_at":"2026-05-06 22:30:45"},"problem_types":["CWE-200","n/a"],"metrics":[{"version":"3.0","source":"nvd@nist.gov","type":"Primary","score":"5.5","severity":"MEDIUM","vector":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","data":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"}},{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:N/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"}}],"references":[{"url":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5","name":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"arm64: dma-mapping: always clear allocated buffers · torvalds/linux@6829e27 · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://source.android.com/security/bulletin/2016-10-01.html","name":"http://source.android.com/security/bulletin/2016-10-01.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Android Security Bulletin—October 2016 | Android Open Source Project","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/93318","name":"http://www.securityfocus.com/bid/93318","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Linux Kernel CVE-2015-8950 Information Disclosure Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5","name":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"kernel/git/torvalds/linux.git - Linux kernel source tree","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8","name":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Issue Tracking","Patch"],"title":"kernel/msm-3.10 - Unnamed repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3","name":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Release Notes"],"title":"","mime":"text/plain","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-8950","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-8950","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2015","cve_id":"8950","vulnerable":"1","versionEndIncluding":"4.0.2","cpe1":"cpe","cpe2":"2.3","cpe3":"o","cpe4":"linux","cpe5":"linux_kernel","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":{"cve_year":"2015","cve_id":"8950","cve":"CVE-2015-8950","epss":"0.001470000","percentile":"0.346830000","score_date":"2026-05-07","updated_at":"2026-05-08 00:14:43"},"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-06T08:36:30.390Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://source.android.com/security/bulletin/2016-10-01.html"},{"name":"93318","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/93318"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2015-05-13T00:00:00.000Z","descriptions":[{"lang":"en","value":"arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2016-11-25T19:57:01.000Z","orgId":"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6","shortName":"google_android"},"references":[{"tags":["x_refsource_CONFIRM"],"url":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8"},{"tags":["x_refsource_CONFIRM"],"url":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5"},{"tags":["x_refsource_CONFIRM"],"url":"http://source.android.com/security/bulletin/2016-10-01.html"},{"name":"93318","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/93318"},{"tags":["x_refsource_CONFIRM"],"url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3"},{"tags":["x_refsource_CONFIRM"],"url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"security@android.com","ID":"CVE-2015-8950","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8","refsource":"CONFIRM","url":"https://source.codeaurora.org/quic/la/kernel/msm-3.10/commit/?id=6e2c437a2d0a85d90d3db85a7471f99764f7bbf8"},{"name":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5","refsource":"CONFIRM","url":"https://github.com/torvalds/linux/commit/6829e274a623187c24f7cfc0e3d35f25d087fcc5"},{"name":"http://source.android.com/security/bulletin/2016-10-01.html","refsource":"CONFIRM","url":"http://source.android.com/security/bulletin/2016-10-01.html"},{"name":"93318","refsource":"BID","url":"http://www.securityfocus.com/bid/93318"},{"name":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3","refsource":"CONFIRM","url":"http://www.kernel.org/pub/linux/kernel/v4.x/ChangeLog-4.0.3"},{"name":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5","refsource":"CONFIRM","url":"http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6829e274a623187c24f7cfc0e3d35f25d087fcc5"}]}}}},"cveMetadata":{"assignerOrgId":"baff130e-b8d5-4e15-b3d3-c3cf5d5545c6","assignerShortName":"google_android","cveId":"CVE-2015-8950","datePublished":"2016-10-10T10:00:00.000Z","dateReserved":"2016-08-11T00:00:00.000Z","dateUpdated":"2024-08-06T08:36:30.390Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2016-10-10 10:59:01","lastModifiedDate":"2026-05-06 22:30:45","problem_types":["CWE-200","n/a"],"metrics":{"cvssMetricV30":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","baseScore":5.5,"baseSeverity":"MEDIUM","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"NONE","userInteraction":"REQUIRED","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"NONE","availabilityImpact":"NONE"},"exploitabilityScore":1.8,"impactScore":3.6}],"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:N/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"NONE","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*","versionEndIncluding":"4.0.2","matchCriteriaId":"3918BCE8-1066-4D3E-A44A-126FCFA0C97B"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2015","CveId":"8950","Ordinal":"1","Title":"CVE-2015-8950","CVE":"CVE-2015-8950","Year":"2015"},"notes":[{"CveYear":"2015","CveId":"8950","Ordinal":"1","NoteData":"arch/arm64/mm/dma-mapping.c in the Linux kernel before 4.0.3, as used in the ION subsystem in Android and other products, does not initialize certain data structures, which allows local users to obtain sensitive information from kernel memory by triggering a dma_mmap call.","Type":"Description","Title":"CVE-2015-8950"},{"CveYear":"2015","CveId":"8950","Ordinal":"2","NoteData":"2016-10-10","Type":"Other","Title":"Published"},{"CveYear":"2015","CveId":"8950","Ordinal":"3","NoteData":"2016-11-25","Type":"Other","Title":"Modified"}]}}}