PT-2013-6344 · Linux+2 · Linux Kernel+6

Published 1970-01-01 · Updated 2017-08-29 · CVE-2014-1446

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.12.8 SUSE Linux Enterprise kernel-pae-devel (affected versions not specified) SUSE Linux Enterprise kernel-xen-devel (affected versions not specified) SUSE Linux Enterprise gfs2-kmp-xen (affected versions not specified) SUSE Linux Enterprise kernel-ec2-devel (affected versions not specified)

Description The issue allows local users to obtain sensitive information from kernel memory by leveraging the CAP NET ADMIN capability for an SIOCYAMGCFG ioctl call. Multiple vulnerabilities in SUSE Linux Enterprise packages may lead to disruption of confidentiality, integrity, and availability of protected information. These vulnerabilities can be exploited remotely.

Recommendations For Linux kernel versions prior to 3.12.8, update to version 3.12.8 or later to resolve the issue. For SUSE Linux Enterprise kernel-pae-devel, kernel-xen-devel, gfs2-kmp-xen, and kernel-ec2-devel, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2014-1065

ALT-PU-2014-1422

BDU:2015-04307

BDU:2015-04308

BDU:2015-04309

BDU:2015-04310

CVE-2014-1446

DSA-2906-1

MGASA-2014-0038

MGASA-2014-0043

MGASA-2014-0044

MGASA-2014-0045

MGASA-2014-0055

MGASA-2014-0064

OPENSUSE-SU-2014_0677-1

OPENSUSE-SU-2014_0678-1

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2113-1

USN-2117-1

USN-2128-1

USN-2129-1

USN-2133-1

USN-2134-1

USN-2135-1

USN-2136-1

USN-2138-1

USN-2139-1

USN-2141-1

Affected Products

Alt Linux

Linux Kernel

Suse Linux Enterprise Gfs2-Kmp-Xen

Suse Linux Enterprise Kernel-Ec2-Devel

Suse Linux Enterprise Kernel-Pae-Devel

Suse Linux Enterprise Kernel-Xen-Devel

Suse

References · 300

• 🔥 https://github.com/luan0ap/cve-2018-14634 · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://github.com/torvalds/linux/commit/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed · Patch
• http://ubuntu.com/usn/USN-2113-1 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8173 · Security Note
• https://osv.dev/vulnerability/MGASA-2014-0064 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9870 · Security Note
• https://bdu.fstec.ru/vul/2016-02003 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2888 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2929 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4299 · Security Note
• https://bdu.fstec.ru/vul/2014-00333 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-2891 · Security Note
• https://bdu.fstec.ru/vul/2014-00091 · Security Note
• https://bdu.fstec.ru/vul/2014-00052 · Security Note