PT-2013-6331 · Linux+5 · Linux Kernel+5

Published 1970-01-01 · Updated 2024-02-16 · CVE-2014-4699

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.15.4

Description The issue is related to the Linux kernel's handling of non-canonical values for the saved RIP address in system calls that do not use IRET. This can allow local users to leverage a race condition and gain privileges or cause a denial of service (double fault) via a crafted application that makes ptrace and fork system calls. The vulnerability can be exploited remotely.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2014-1898

ALT-PU-2014-1899

ALT-PU-2014-1900

ALT-PU-2014-1903

ALT-PU-2014-1904

ALT-PU-2014-1909

ALT-PU-2014-1953

ALT-PU-2015-1794

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

BDU:2015-05685

BDU:2015-05686

BDU:2015-05687

BDU:2015-05688

BDU:2015-05689

BDU:2015-05690

BDU:2015-05691

BDU:2015-05692

BDU:2015-05693

BDU:2015-05694

BDU:2015-05695

BDU:2015-05696

BDU:2015-05697

BDU:2015-05698

BDU:2015-05699

BDU:2015-05700

BDU:2015-05701

BDU:2015-05702

BDU:2015-05703

BDU:2015-05704

BDU:2015-05705

BDU:2015-05706

BDU:2015-05707

BDU:2015-05708

BDU:2015-05709

BDU:2015-05710

BDU:2015-05711

BDU:2015-05712

BDU:2015-05713

BDU:2015-05714

BDU:2015-05715

BDU:2015-05716

BDU:2015-05717

BDU:2015-05718

BDU:2015-05719

BDU:2015-05720

BDU:2015-05721

BDU:2015-05722

BDU:2015-05723

BDU:2015-05724

BDU:2015-05725

BDU:2015-05726

BDU:2015-05727

BDU:2015-05728

BDU:2015-05729

BDU:2015-05730

BDU:2015-05731

BDU:2015-05732

BDU:2015-05733

BDU:2015-05734

BDU:2015-05735

BDU:2015-05736

BDU:2015-05737

BDU:2015-05738

BDU:2015-05739

BDU:2015-05740

BDU:2015-05741

BDU:2015-05742

BDU:2015-05743

BDU:2015-05744

BDU:2015-05745

BDU:2015-05746

BDU:2015-05747

BDU:2015-05748

BDU:2015-05749

BDU:2015-05750

BDU:2015-05751

BDU:2015-05752

BDU:2015-05753

BDU:2015-05754

BDU:2015-05755

BDU:2015-05756

BDU:2015-05757

BDU:2015-05758

BDU:2015-05759

BDU:2015-05760

BDU:2015-05761

BDU:2015-05762

BDU:2015-05763

BDU:2015-05764

BDU:2015-05765

BDU:2015-05766

BDU:2015-05767

BDU:2015-05768

BDU:2015-05769

BDU:2015-05770

BDU:2015-05771

BDU:2015-05772

BDU:2015-05773

BDU:2015-05774

BDU:2015-05775

BDU:2015-05776

BDU:2015-05777

BDU:2015-05778

BDU:2015-05779

BDU:2015-05780

BDU:2015-05781

BDU:2015-05782

BDU:2015-05783

BDU:2015-05784

BDU:2015-05785

BDU:2015-05786

BDU:2015-05787

BDU:2015-05788

BDU:2015-05789

BDU:2015-05790

BDU:2015-05791

BDU:2015-05792

BDU:2015-05793

BDU:2015-05794

BDU:2015-05795

BDU:2015-05796

BDU:2015-05797

BDU:2015-05798

BDU:2015-05799

BDU:2015-05800

BDU:2015-05801

BDU:2015-05802

BDU:2015-05803

BDU:2015-05804

BDU:2015-05805

BDU:2015-05806

BDU:2015-05807

BDU:2015-05808

BDU:2015-05809

BDU:2015-05810

BDU:2015-05811

BDU:2015-05812

BDU:2015-05813

BDU:2015-05814

BDU:2015-05815

BDU:2015-05816

BDU:2015-05817

BDU:2015-05818

BDU:2015-05819

BDU:2015-05820

BDU:2015-05821

BDU:2015-05822

BDU:2015-05823

BDU:2015-05824

BDU:2015-05825

BDU:2015-05826

BDU:2015-05827

BDU:2015-05828

BDU:2015-05829

BDU:2015-05830

BDU:2015-05831

BDU:2015-05832

BDU:2015-05833

BDU:2015-05834

BDU:2015-05835

BDU:2015-05836

BDU:2015-05837

BDU:2015-05838

BDU:2015-05839

BDU:2015-05840

BDU:2015-05841

BDU:2015-05842

BDU:2015-05843

BDU:2016-01579

CESA-2014_0923

CESA-2014_0924

CVE-2014-4699

DLA-0015-1

DSA-2972-1

OPENSUSE-SU-2014_0957-1

OPENSUSE-SU-2014_0985-1

RHSA-2014:0913

RHSA-2014:0923

RHSA-2014:0924

RHSA-2014:0925

RHSA-2014:0949

RHSA-2014_0923

RHSA-2014_0924

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2266-1

USN-2267-1

USN-2268-1

USN-2269-1

USN-2270-1

USN-2271-1

USN-2272-1

USN-2273-1

USN-2274-1

USN-2284-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 233

• 🔥 https://github.com/retme7/CVE-2014-4322_poc · Exploit
• 🔥 https://github.com/panyu6325/CVE-2015-1805 · Exploit
• 🔥 https://github.com/laginimaineb/cve-2014-4322 · Exploit
• 🔥 https://github.com/marcograss/cve-2014-4323 · Exploit
• 🔥 https://github.com/FloatingGuy/cve-2015-1805 · Exploit
• 🔥 https://github.com/ireshchaminda1/Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805 · Exploit
• 🔥 https://exploit-db.com/exploits/34134 · Exploit
• 🔥 http://exploit-db.com/exploits/34134 · Exploit
• 🔥 http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html · Exploit
• https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a · Patch
• https://ubuntu.com/security/notices/USN-2274-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05777 · Security Note
• https://bdu.fstec.ru/vul/2015-05705 · Security Note
• https://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-05698 · Security Note