PT-2014-4874 · Linux+4 · Linux Kernel+4

Yaara Rozenblum · Published 2014-03-24 · Updated 2023-05-19 · CVE-2014-2706

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.13.7

Description A race condition in the mac80211 subsystem allows remote attackers to cause a denial of service (system crash) via network traffic that improperly interacts with the WLAN STA PS STA state, also known as power-save mode. This issue is related to the sta info.c and tx.c files.

Recommendations For Linux kernel versions prior to 3.13.7, update to version 3.13.7 or later to resolve the issue. As a temporary workaround, consider restricting network traffic to minimize the risk of exploitation.

Exploit

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2014-1355

ALT-PU-2014-1362

CESA-2014_0981

CESA-2014_1023

CVE-2014-2706

RHSA-2014:0557

RHSA-2014:0981

RHSA-2014:1023

RHSA-2014:1101

RHSA-2014_0981

RHSA-2014_1023

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2221-1

USN-2223-1

USN-2224-1

USN-2225-1

USN-2227-1

USN-2228-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

References · 31

• 🔥 https://github.com/torvalds/linux/commit/1d147bfa64293b2723c4fec50922168658e613ba · Exploit
• 🔥 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1d147bfa64293b2723c4fec50922168658e613ba · Exploit
• https://linux.oracle.com/errata/ELSA-2014-3052.html · Vendor Advisory
• http://kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.7 · Vendor Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1083512 · Patch
• https://osv.dev/vulnerability/DEBIAN-CVE-2014-2706 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2014-2706 · Security Note
• http://openwall.com/lists/oss-security/2014/04/01/8 · Patch
• https://security-tracker.debian.org/tracker/CVE-2014-2706 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-0981.html · Vendor Advisory
• https://osv.dev/vulnerability/UBUNTU-CVE-2014-2706 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1023.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2228-1 · Vendor Advisory
• https://source.android.com/security/bulletin/2017-04-01 · Patch