PT-2013-6346 · Suse+4 · Suse Linux Enterprise Kernel-Ec2-Devel+8

Petr Matousek · Publicado 1970-01-01 · Atualizado 2023-01-19 · CVE-2014-2523

Positive Technologies (AI Summary)

CVSS v2.0

10

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.13.6 SUSE Linux Enterprise kernel-pae-devel (affected versions not specified) SUSE Linux Enterprise kernel-xen-devel (affected versions not specified) SUSE Linux Enterprise gfs2-kmp-xen (affected versions not specified) SUSE Linux Enterprise kernel-ec2-devel (affected versions not specified)

Description The issue involves multiple vulnerabilities in the Linux kernel and various SUSE Linux Enterprise packages, which can be exploited remotely to compromise the confidentiality, integrity, and availability of protected information. Specifically, the Linux kernel through version 3.13.6 incorrectly uses a DCCP header pointer in the net/netfilter/nf conntrack proto dccp.c file, allowing remote attackers to cause a denial of service or possibly execute arbitrary code via a DCCP packet that triggers a call to the dccp new, dccp packet, or dccp error function.

Recommendations For Linux kernel versions prior to 3.13.6, update to a version 3.13.6 or later to resolve the issue. For SUSE Linux Enterprise kernel-pae-devel, kernel-xen-devel, gfs2-kmp-xen, and kernel-ec2-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

ALT-PU-2014-1329

ALT-PU-2014-1330

ALT-PU-2014-1333

ALT-PU-2014-1337

ALT-PU-2014-1340

ALT-PU-2014-1349

ALT-PU-2014-1350

ALT-PU-2014-1441

ALT-PU-2014-1458

ALT-PU-2014-1547

ALT-PU-2014-1606

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

CESA-2014_0475

CVE-2014-2523

DSA-2906-1

OPENSUSE-SU-2014_0677-1

OPENSUSE-SU-2014_0678-1

RHSA-2014:0439

RHSA-2014:0475

RHSA-2014:0520

RHSA-2014:0593

RHSA-2014:0634

RHSA-2014_0475

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2173-1

USN-2174-1

USN-2221-1

USN-2223-1

USN-2224-1

USN-2225-1

USN-2227-1

USN-2228-1

Produtos afetados

Alt Linux

Centos

Linux Kernel

Red Hat

Suse Linux Enterprise Gfs2-Kmp-Xen

Suse Linux Enterprise Kernel-Ec2-Devel

Suse Linux Enterprise Kernel-Pae-Devel

Suse Linux Enterprise Kernel-Xen-Devel

Suse

Referências · 38

• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/b22f5126a24b3b2f15448c3f2a254fc10cbc2b92 · Correção
• http://securitytracker.com/id/1029945 · Nota
• https://linux.oracle.com/errata/ELSA-2014-3016.html · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/91910 · Nota
• http://twitter.com/grsecurity/statuses/445496197399461888 · Nota
• http://secunia.com/advisories/57446 · Nota
• https://cve.org/CVERecord?id=CVE-2014-2523 · Nota de Segurança
• https://ubuntu.com/security/notices/USN-2173-1 · Aviso do Fabricante
• http://openwall.com/lists/oss-security/2014/03/17/7 · Correção
• https://ubuntu.com/security/notices/USN-2228-1 · Aviso do Fabricante
• https://ubuntu.com/security/CVE-2014-2523 · Aviso do Fabricante
• http://ubuntu.com/usn/USN-2174-1 · Aviso do Fabricante
• https://ubuntu.com/security/notices/USN-2225-1 · Aviso do Fabricante
• https://security-tracker.debian.org/tracker/CVE-2014-2523 · Aviso do Fabricante