PT-2014-5620 · Linux+4 · Linux Kernel+4

Sasha Levin · Published 2014-06-05 · Updated 2021-07-15 · CVE-2014-3940

Positive Technologies (AI Summary)

CVSS v2.0

4.0

Medium

Base vector

AV:L/AC:H/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.14.5

Description The issue allows local users to cause a denial of service, resulting in memory corruption or system crash, by accessing certain memory locations. This can be achieved by triggering a race condition via numa maps read operations during hugepage migration. The problem is related to the fs/proc/task mmu.c and mm/mempolicy.c files.

Recommendations For Linux kernel versions prior to 3.14.5, update to version 3.14.5 or later to resolve the issue. As a temporary workaround, consider restricting access to hugepage migration to minimize the risk of exploitation.

Exploit

Fix

DoS

Race Condition

Weakness Enumeration

CWE-362

Related Identifiers

ALT-PU-2014-1765

ALT-PU-2014-2064

CESA-2015_0290

CESA-2015_1272

CVE-2014-3940

RHSA-2014:0913

RHSA-2015:0290

RHSA-2015:1272

RHSA-2015_0290

RHSA-2015_1272

USN-2288-1

USN-2290-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Ubuntu

References · 369

• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/android/local/futex_requeue.rb · Exploit
• 🔥 https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/local/recvmmsg_priv_esc.rb · Exploit
• 🔥 https://github.com/saelo/cve-2014-0038 · Exploit
• 🔥 https://github.com/timwr/CVE-2014-3153 · Exploit
• 🔥 https://github.com/android-rooting-tools/libfutex_exploit · Exploit
• 🔥 https://github.com/lieanu/CVE-2014-3153 · Exploit
• 🔥 https://github.com/elongl/CVE-2014-3153 · Exploit
• 🔥 https://github.com/zerodavinci/CVE-2014-3153-exploit · Exploit
• 🔥 https://github.com/tempbottle/CVE-2014-0196 · Exploit
• https://bdu.fstec.ru/vul/2015-05721 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8173 · Security Note
• https://bdu.fstec.ru/vul/2015-05743 · Security Note
• https://bdu.fstec.ru/vul/2015-05902 · Security Note
• https://bdu.fstec.ru/vul/2015-05751 · Security Note
• https://bdu.fstec.ru/vul/2015-05838 · Security Note