PT-2015-4294 · Linux+5 · Linux Kernel+5

Carl Henrik Lunde · Published 2015-01-09 · Updated 2023-02-13 · CVE-2014-9584

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:L/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 3.18.2

Description The issue concerns a function in the Linux kernel that does not properly validate a length value in a specific field of an iso9660 image, allowing local users to access sensitive information from kernel memory by using a crafted image.

Recommendations For versions prior to 3.18.2, update to version 3.18.2 or later to resolve the issue.

Exploit

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

ALT-PU-2015-1018

ALT-PU-2015-1794

CESA-2015_0864

CESA-2015_1137

CVE-2014-9584

DLA-155-1

DSA-3128-1

MGASA-2015-0070

MGASA-2015-0075

MGASA-2015-0076

MGASA-2015-0077

MGASA-2015-0078

OPENSUSE-SU-2015_0713-1

OPENSUSE-SU-2015_0714-1

RHSA-2015:0864

RHSA-2015:1137

RHSA-2015:1138

RHSA-2015:1139

RHSA-2015_0864

RHSA-2015_1137

RHSA-2015_1139

SUSE-RU-2015:0621-1

SUSE-SU-2015:0481-1

SUSE-SU-2015:0529-1

SUSE-SU-2015:0581-1

SUSE-SU-2015:0652-1

SUSE-SU-2015:0736-1

SUSE-SU-2015:1174-1

SUSE-SU-2015:1376-1

USN-2511-1

USN-2512-1

USN-2513-1

USN-2514-1

USN-2515-1

USN-2516-1

USN-2516-2

USN-2516-3

USN-2517-1

USN-2518-1

Affected Products

Alt Linux

Centos

Linux Kernel

Red Hat

Suse

Ubuntu

References · 197

• 🔥 https://github.com/retme7/CVE-2014-4322_poc · Exploit
• 🔥 https://github.com/panyu6325/CVE-2015-1805 · Exploit
• 🔥 https://github.com/laginimaineb/cve-2014-4322 · Exploit
• 🔥 https://github.com/marcograss/cve-2014-4323 · Exploit
• 🔥 https://github.com/FloatingGuy/cve-2015-1805 · Exploit
• 🔥 https://github.com/ireshchaminda1/Android-Privilege-Escalation-Remote-Access-Vulnerability-CVE-2015-1805 · Exploit
• https://github.com/torvalds/linux/commit/4e2024624e678f0ebb916e6192bd23c1f9fdf696 · Patch
• https://ubuntu.com/security/CVE-2014-9529 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0077 · Vendor Advisory
• https://advisories.mageia.org/MGASA-2015-0076.html · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2015:058 · Vendor Advisory
• https://ubuntu.com/security/CVE-2014-9428 · Vendor Advisory
• https://osv.dev/vulnerability/MGASA-2015-0078 · Vendor Advisory
• https://linux.oracle.com/errata/ELSA-2015-3034.html · Vendor Advisory
• http://ubuntu.com/usn/USN-2518-1 · Vendor Advisory