CVE-2015-3335

2015-04-1900:00:00

ubuntu.com

7.5 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:P/I:P/A:P

0.005 Low

EPSS

Percentile

75.9%

JSON

The NaClSandbox::InitializeLayerTwoSandbox function in
components/nacl/loader/sandbox_linux/nacl_sandbox_linux.cc in Google Chrome
before 42.0.2311.90 does not have RLIMIT_AS and RLIMIT_DATA limits for
Native Client (aka NaCl) processes, which might make it easier for remote
attackers to conduct row-hammer attacks or have unspecified other impact by
leveraging the ability to run a crafted program in the NaCl sandbox.