PT-2014-1823 · Linux+5 · Linux Kernel+5

Published 2014-11-10 · Updated 2023-02-13 · CVE-2014-3673

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Red Hat Enterprise Linux kernel versions 2.6.32 Linux kernel versions prior to 3.17.2

Description The issue affects the Linux kernel and Red Hat Enterprise Linux, allowing remote attackers to cause a denial of service or disrupt the confidentiality, integrity, and availability of protected information. The exploitation can be done remotely. The SCTP implementation in the Linux kernel is specifically vulnerable to a denial of service attack via a malformed ASCONF chunk.

Recommendations For Red Hat Enterprise Linux kernel version 2.6.32, update to a version that includes the necessary security patches. For Linux kernel versions prior to 3.17.2, update to version 3.17.2 or later to resolve the issue. As a temporary workaround, consider restricting access to the SCTP implementation until a patch is available.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-399

CWE-20

Related Identifiers

ALT-PU-2014-2380

ALT-PU-2014-2381

BDU:2015-06243

BDU:2015-06250

BDU:2015-06263

BDU:2015-06264

BDU:2015-06265

CESA-2014_1971

CESA-2014_1997

CVE-2014-3673

DSA-3060-1

OPENSUSE-SU-2014_1677-1

OPENSUSE-SU-2014_1678-1

RHSA-2014:1971

RHSA-2014:1997

RHSA-2014_1971

RHSA-2014_1997

RHSA-2015:0043

RHSA-2015:0062

RHSA-2015:0115

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0529-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

SUSE-SU-2015_0529-1

USN-2417-1

USN-2418-1

USN-2441-1

USN-2442-1

USN-2445-1

USN-2446-1

USN-2447-1

USN-2447-2

USN-2448-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 134

• 🔥 https://github.com/torvalds/linux/commit/9de7922bc709eee2f609cd01d98aaedc4cf5ea74 · Exploit
• 🔥 https://github.com/RKX1209/CVE-2014-9322 · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=9de7922bc709eee2f609cd01d98aaedc4cf5ea74 · Exploit
• 🔥 https://bugzilla.redhat.com/show_bug.cgi?id=1147850 · Exploit
• https://ubuntu.com/security/CVE-2014-7970 · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06243 · Security Note
• https://ubuntu.com/security/CVE-2014-3673 · Vendor Advisory
• http://marc.info/?l=bugtraq&m=142722544401658&w=2 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8086 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1997.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2418-1 · Vendor Advisory
• https://bdu.fstec.ru/vul/2015-06263 · Security Note
• https://security-tracker.debian.org/tracker/CVE-2014-3673 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2448-1 · Vendor Advisory