PT-2013-6343 · Linux+2 · Linux Kernel+3

Prasad Pandit · Publicado 1970-01-01 · Atualizado 2017-08-29 · CVE-2014-1445

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions SUSE Linux Enterprise kernel-pae-devel (affected versions not specified) SUSE Linux Enterprise kernel-xen-devel (affected versions not specified) SUSE Linux Enterprise gfs2-kmp-xen (affected versions not specified) Linux kernel versions prior to 3.11.7 SUSE Linux Enterprise kernel-ec2-devel (affected versions not specified)

Description The issue concerns multiple vulnerabilities in various packages of the SUSE Linux Enterprise operating system, including kernel-pae-devel, kernel-xen-devel, gfs2-kmp-xen, and kernel-ec2-devel. These vulnerabilities can be exploited remotely and may lead to a breach of confidentiality, integrity, and availability of protected information. Additionally, a specific vulnerability in the Linux kernel before version 3.11.7 allows local users to obtain sensitive information from kernel memory via an ioctl call to the wanxl ioctl function in drivers/net/wan/wanxl.c.

Recommendations For SUSE Linux Enterprise kernel-pae-devel, consider disabling the vulnerable components until a patch is available. For SUSE Linux Enterprise kernel-xen-devel, restrict access to the vulnerable modules to minimize the risk of exploitation. For SUSE Linux Enterprise gfs2-kmp-xen, avoid using the vulnerable functions until the issue is resolved. For Linux kernel versions prior to 3.11.7, update to version 3.11.7 or later to resolve the issue. For SUSE Linux Enterprise kernel-ec2-devel, consider disabling the vulnerable components until a patch is available. At the moment, there is no information about a newer version that contains a fix for the SUSE Linux Enterprise kernel-pae-devel, kernel-xen-devel, gfs2-kmp-xen, and kernel-ec2-devel vulnerabilities.

Exploit

Correção

Enumeração de Fraquezas

CWE-399

Identificadores relacionados

ALT-PU-2013-1053

ALT-PU-2014-1422

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

CVE-2014-1445

DSA-2906-1

OPENSUSE-SU-2014_0677-1

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2040-1

USN-2042-1

USN-2049-1

USN-2050-1

USN-2066-1

USN-2067-1

USN-2069-1

USN-2128-1

USN-2129-1

Produtos afetados

Alt Linux

Linux Kernel

Suse Linux Enterprise

Suse

Referências · 237

• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00 · Nota
• https://github.com/torvalds/linux/commit/12ae030d54ef250706da5642fc7697cc60ad0df7 · Nota
• https://github.com/torvalds/linux/commit/929473ea05db455ad88cdc081f2adc556b8dc48f · Nota
• https://github.com/torvalds/linux/commit/d049f74f2dbe71354d43d393ac3a188947811348 · Nota
• https://github.com/torvalds/linux/commit/c547dbf55d5f8cf615ccc0e7265e98db27d3fb8b · Nota
• https://github.com/torvalds/linux/commit/2811ebac2521ceac84f2bdae402455baa6a7fb47 · Nota
• https://github.com/torvalds/linux/commit/95ee62083cb6453e056562d91f597552021e6ae7 · Nota
• https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886 · Nota
• https://github.com/torvalds/linux/commit/201f99f170df14ba52ea4c52847779042b7a623b · Nota
• https://github.com/torvalds/linux/commit/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1 · Correção
• https://github.com/torvalds/linux/commit/6fb392b1a63ae36c31f62bc3fc8630b49d602b62 · Nota
• https://github.com/torvalds/linux/commit/a8b33654b1e3b0c74d4a1fed041c9aae50b3c427 · Nota
• https://github.com/torvalds/linux/commit/e93b7d748be887cd7639b113ba7d7ef792a7efb9 · Nota