CVE-1999-1214: Low severity SGI IRIX vulnerability
The asynchronous I/O facility in 4.4 BSD kernel does not check user credentials when setting the recipient of I/O notification, which allows local users to cause a denial of service by using certain ioctl and fcntl calls to cause the signal to be sent to an arbitrary process ID.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable the asynchronous I/O facility (remove or disable AIO support in the kernel/build or via available kernel configuration) to prevent local users from using ioctl/fcntl to set an arbitrary signal recipient.
4.4BSD kernel asynchronous I/O facility asynchronous I/O (AIO) notification recipient handling = disabled - Compensating control
Restrict untrusted local user accounts and limit local access that can invoke ioctl/fcntl (restrict access to relevant device nodes and interfaces, apply strong local account policies or MAC/jail isolation) to reduce the ability of local users to exploit the AIO notification handling flaw.
- Operational
Monitor for and apply any vendor or upstream kernel security updates or patches addressing the asynchronous I/O notification credential-checking issue as soon as they are released; install the kernel update and reboot affected systems when available.
Event History
Frequently Asked Questions
What is the severity of CVE-1999-1214?
CVE-1999-1214 is classified as a medium severity vulnerability due to its potential to cause denial of service.
How do I fix CVE-1999-1214?
Fixing CVE-1999-1214 involves applying updates provided by the affected operating system vendors that mitigate the flaw.
Who is affected by CVE-1999-1214?
CVE-1999-1214 affects local users on systems running specific versions of BSD, OpenBSD, FreeBSD, NetBSD, and SGI IRIX.
What type of vulnerability is CVE-1999-1214?
CVE-1999-1214 is a local denial of service vulnerability related to improper credential checks in asynchronous I/O.
Can remote users exploit CVE-1999-1214?
No, CVE-1999-1214 can only be exploited by local users with access to the affected systems.