PT-2014-6269 · Linux+5 · Linux Kernel+5

Jason Gunthorpe · Published 2014-08-01 · Updated 2023-05-19 · CVE-2014-5077

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.15.9

Description The issue allows remote attackers to cause a denial of service, resulting in a NULL pointer dereference and OOPS, when SCTP authentication is enabled. This occurs by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

Recommendations For Linux kernel versions prior to 3.15.9, update to version 3.15.9 or later to resolve the issue.

Exploit

Fix

DoS

NULL Pointer Dereference

Weakness Enumeration

CWE-476

Related Identifiers

ALT-PU-2014-1981

ALT-PU-2014-1982

ALT-PU-2014-1983

ALT-PU-2014-2009

ALT-PU-2014-2043

CESA-2014_1392

CESA-2014_1724

CVE-2014-5077

DLA-103-1

MGASA-2014-0316

MGASA-2014-0318

MGASA-2014-0336

MGASA-2014-0337

OPENSUSE-SU-2014_1669-1

OPENSUSE-SU-2014_1677-1

RHSA-2014:1083

RHSA-2014:1392

RHSA-2014:1668

RHSA-2014:1724

RHSA-2014:1763

RHSA-2014:1872

RHSA-2014_1392

RHSA-2014_1724

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2332-1

USN-2333-1

USN-2334-1

USN-2335-1

USN-2358-1

USN-2359-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 70

• 🔥 https://github.com/hiikezoe/libfb_mem_exploit · Exploit
• 🔥 https://github.com/RKX1209/CVE-2014-9322 · Exploit
• https://github.com/torvalds/linux/commit/1be9a950c646c9092fb3618197f7b6bfb50e82aa · Patch
• https://advisories.mageia.org/MGASA-2014-0318.html · Security Note
• https://ubuntu.com/security/notices/USN-2359-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5472 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-1724.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1668.html · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2014-0336 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2358-1 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3082.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-5077 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2014-3083.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2014-1763.html · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2332-1 · Vendor Advisory