PT-2013-6340 · Linux+5 · Linux Kernel+5

Published 1970-01-01 · Updated 2023-02-13 · CVE-2014-0077

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.13.10

Description The issue allows guest OS users to cause a denial of service or possibly gain privileges on the host OS via crafted packets. This is related to the handle rx and get rx bufs functions in the Linux kernel. The vulnerability can be exploited remotely and may lead to a violation of confidentiality, integrity, and availability of protected information.

Recommendations For Linux kernel versions prior to 3.13.10, update to version 3.13.10 or later to resolve the issue. As a temporary workaround, consider restricting access to the handle rx and get rx bufs functions until a patch is available.

Exploit

Fix

DoS

Memory Corruption

Weakness Enumeration

CWE-787

Related Identifiers

ALT-PU-2014-1489

ALT-PU-2014-1547

ALT-PU-2014-1606

ALT-PU-2014-2064

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

CESA-2014_0475

CVE-2014-0077

MGASA-2014-0206

MGASA-2014-0207

MGASA-2014-0208

MGASA-2014-0228

MGASA-2014-0229

MGASA-2014-0234

MGASA-2014-0235

MGASA-2014-0236

MGASA-2014-0237

MGASA-2014-0238

OPENSUSE-SU-2014_0840-1

OPENSUSE-SU-2014_0856-1

RHSA-2014:0475

RHSA-2014:0593

RHSA-2014:0629

RHSA-2014:0634

RHSA-2014_0475

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2221-1

USN-2223-1

USN-2224-1

USN-2225-1

USN-2226-1

USN-2227-1

USN-2228-1

USN-2260-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 98

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/futex_requeue.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 https://github.com/timwr/CVE-2014-3153 · Exploit
• 🔥 https://github.com/android-rooting-tools/libfutex_exploit · Exploit
• 🔥 https://github.com/lieanu/CVE-2014-3153 · Exploit
• 🔥 https://github.com/elongl/CVE-2014-3153 · Exploit
• 🔥 https://github.com/zerodavinci/CVE-2014-3153-exploit · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/d8316f3991d207fe32881a9ac20241be8fa2bad0 · Patch
• https://advisories.mageia.org/MGASA-2014-0228.html · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-0077 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0234 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-2851 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2228-1 · Vendor Advisory