PT-2016-2606 · Linux+3 · Linux Kernel+3

Published 2016-08-06 · Updated 2026-03-13 · CVE-2014-9900

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Linux kernel versions prior to 4.7

Description The issue is related to the ethtool get wol function in the Linux kernel, which does not initialize a certain data structure. This can be exploited by a local user or a remote attacker using a specially crafted application to obtain sensitive information.

Recommendations For Linux kernel versions prior to 4.7, update to a version later than 4.7 to resolve the issue. As a temporary workaround, consider restricting access to the ethtool get wol function until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

ALT-PU-2016-1862

ALT-PU-2017-1330

BDU:2016-01998

CVE-2014-9900

ECHO-B65A-125B-C6DC

USN-3358-1

USN-3359-1

USN-3360-1

USN-3360-2

USN-3364-1

USN-3364-2

USN-3364-3

USN-3371-1

Affected Products

Alt Linux

Debian

Linux Kernel

Ubuntu

References · 41

• https://osv.dev/vulnerability/DEBIAN-CVE-2014-9900 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3360-1 · Vendor Advisory
• https://osv.dev/vulnerability/USN-3371-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8964 · Vendor Advisory
• https://ubuntu.com/security/CVE-2015-8963 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3360-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3371-1 · Vendor Advisory
• https://ubuntu.com/security/CVE-2017-9605 · Vendor Advisory
• http://source.android.com/security/bulletin/2016-08-01.html · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2014-9900 · Security Note
• https://cve.org/CVERecord?id=CVE-2014-9900 · Security Note
• https://ubuntu.com/security/CVE-2015-8944 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3364-3 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3364-1 · Vendor Advisory
• https://ubuntu.com/security/notices/USN-3359-1 · Vendor Advisory