PT-2015-4196 · Linux+3 · Linux Kernel+3

Philipp Psurek · Published 2015-01-02 · Updated 2023-01-20 · CVE-2014-9428

Positive Technologies (AI Summary)

CVSS v2.0

7.8

High

Base vector

AV:N/AC:L/Au:N/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linux kernel versions through 3.18.1

Description The issue is related to the batadv frag merge packets function in the B.A.T.M.A.N. implementation, which uses an incorrect length field during a calculation of an amount of memory. This allows remote attackers to cause a denial of service, resulting in a mesh-node system crash via fragmented packets.

Recommendations For Linux kernel versions through 3.18.1, update to a version newer than 3.18.1 to resolve the issue. As a temporary workaround, consider restricting access to the batadv frag merge packets function until a patch is available.

Fix

DoS

Weakness Enumeration

CWE-399

Related Identifiers

ALT-PU-2015-1099

ALT-PU-2015-1101

CVE-2014-9428

MGASA-2015-0070

MGASA-2015-0075

MGASA-2015-0076

MGASA-2015-0077

MGASA-2015-0078

OPENSUSE-SU-2015_0713-1

USN-2515-1

USN-2516-1

USN-2516-2

USN-2516-3

USN-2517-1

USN-2518-1

Affected Products

Alt Linux

Linux Kernel

Suse

Ubuntu

References · 99

• https://github.com/torvalds/linux/commit/5b6698b0e4a37053de35cc24ee695b98a7eb712b · Patch
• https://ubuntu.com/security/CVE-2014-9529 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0077 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8989 · Vendor Advisory
• https://osv.dev/vulnerability/USN-2517-1 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0076.html · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2015:058 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9731 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0075 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-8559 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9428 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0078 · Vendor Advisory
• http://ubuntu.com/usn/USN-2515-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2516-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-2517-1 · Vendor Advisory