PT-2014-1006 · Linux+5 · Linux Kernel+5

Matthew Daley · Publicado 2014-05-09 · Atualizado 2020-08-21 · CVE-2014-1738

Positive Technologies (AI Summary)

CVSS v2.0

4.9

Média

Vetor base

AV:L/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.14.3

Description The issue is related to the raw cmd copyout function in drivers/block/floppy.c, which does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call. This allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device. The problem is due to a lack of input sanitization in the FDRAWCMD ioctl system call, which can lead to information leakage and potentially elevate privileges.

Recommendations For Linux kernel versions through 3.14.3, update to a version that contains a fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-264

Identificadores relacionados

ALT-PU-2014-1604

ALT-PU-2014-1605

ALT-PU-2014-1634

ALT-PU-2014-1802

ALT-PU-2014-1820

ALT-PU-2014-2064

BDU:2014-00052

BDU:2014-00111

CESA-2014_0771

CVE-2014-1738

DSA-2926-1

DSA-2928-1

MGASA-2014-0225

MGASA-2014-0226

MGASA-2014-0227

MGASA-2014-0228

MGASA-2014-0229

MGASA-2014-0234

MGASA-2014-0235

MGASA-2014-0236

MGASA-2014-0237

MGASA-2014-0238

OPENSUSE-SU-2014_0677-1

OPENSUSE-SU-2014_0678-1

RHSA-2014:0557

RHSA-2014:0740

RHSA-2014:0771

RHSA-2014:0772

RHSA-2014:0786

RHSA-2014:0800

RHSA-2014:0801

RHSA-2014:0900

RHSA-2014_0740

RHSA-2014_0771

RHSA-2014_0786

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2219-1

USN-2220-1

USN-2221-1

USN-2223-1

USN-2224-1

USN-2225-1

USN-2226-1

USN-2227-1

USN-2228-1

USN-2260-1

Produtos afetados

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

Referências · 109

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/futex_requeue.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 https://github.com/timwr/CVE-2014-3153 · Exploit
• 🔥 https://github.com/android-rooting-tools/libfutex_exploit · Exploit
• 🔥 https://github.com/lieanu/CVE-2014-3153 · Exploit
• 🔥 https://github.com/elongl/CVE-2014-3153 · Exploit
• 🔥 https://github.com/zerodavinci/CVE-2014-3153-exploit · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/2145e15e0557a01b9195d1c7199a1b92cb9be81f · Nota
• https://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.17 · Nota
• https://advisories.mageia.org/MGASA-2014-0228.html · Nota de Segurança
• http://linux.oracle.com/errata/ELSA-2014-0771.html · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2014-1738 · Nota de Segurança
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-1738 · Aviso do Fabricante