NaCl in 2015 allowed the CLFLUSH instruction, making rowhammer attacks possible.

published 2020-02-25 6 y ago modified 2026-06-17 4 mo ago also EUVD-2015-0578

cvss: 10.0; version 3.1, NVD
cisa kev: Not listed; not in CISA's catalog
epss: 13.6%; EPSS 13.6% chance of exploitation in 30 days, percentile 96%
public exploits: 2; Exploit-DB

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2015-0565 updated 2025-11-21 cvss 8.1

nacl: allowed CLFLUSH instruction could result in rowhammer attack leading to priviledge escalation

Red Hat All currently supported Red Hat products
not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

2015-03-09 First public exploit (EDB-36311)
2020-02-25 Published

Exploit prediction

13.63% chance of exploitation in the next 30 days, higher than 96% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

EDB-36311 Rowhammer - NaCl Sandbox Escape local, 2015-03-09
EDB-36310 Linux Kernel (x86-64) - Rowhammer Privilege Escalation local, 2015-03-09
googleprojectzero.blogspot.com https://googleprojectzero.blogspot.com/2015/03/exploiting-dram-rowhammer-bug-to-gain.html referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by	version	score	vector
NVD	3.1	10.0	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
NVD	2.0	10.0	AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

NaCl NaCL

Classification

Weakness

CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer

References

exploit-db.com /exploits/36310/
exploit, third-party-advisory, vdb-entry
exploit-db.com /exploits/36311/
exploit, third-party-advisory, vdb-entry
googleprojectzero.blogspot.com /2015/03/exploiting-dram-rowhammer-bug-to-gain.html
exploit

Sources

CVE List CVE-2015-0565
NVD CVE-2015-0565

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

Summary