CVE-2014-3153

Linux Kernel Privilege Escalation Vulnerability

Linux Kernel

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

7. Jun 2014

Ausgewertete Quellen

• Debian
  http://www.debian.org/security/2014/dsa-2949
• Red Hat
  http://rhn.redhat.com/errata/RHSA-2014-0800.html
• Red Hat
  https://bugzilla.redhat.com/show_bug.cgi?id=1103626
• Ubuntu
  http://www.ubuntu.com/usn/USN-2237-1
• Ubuntu
  http://www.ubuntu.com/usn/USN-2240-1
• Hinweis
  http://linux.oracle.com/errata/ELSA-2014-0771.html
• Hinweis
  http://linux.oracle.com/errata/ELSA-2014-3037.html
• Hinweis
  http://linux.oracle.com/errata/ELSA-2014-3038.html
• Hinweis
  http://linux.oracle.com/errata/ELSA-2014-3039.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
• Hinweis
  http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
• Hinweis
  http://www.exploit-db.com/exploits/35370
• Hinweis
  http://www.securityfocus.com/bid/67906
• Hinweis
  http://www.securitytracker.com/id/1030451
• CISA
  https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3153
• CISA
  Linux Kernel Privilege Escalation Vulnerability
• NVD
  CVE-2014-3153
• GitHub
  https://github.com/elongl/CVE-2014-3153