CVE-2014-0038: Input Validation

Q: What is the severity of CVE-2014-0038?

CVE-2014-0038 has been rated as having high severity due to the potential for arbitrary write to a user-supplied address.

Q: How do I fix CVE-2014-0038?

To fix CVE-2014-0038, users should update their Linux kernel to a version that is not affected by the vulnerability.

Q: What software versions are affected by CVE-2014-0038?

CVE-2014-0038 affects Linux kernel versions between 3.4 and 3.13.1, particularly those built with the X32 ABI.

Q: What is the impact of CVE-2014-0038?

The impact of CVE-2014-0038 includes the ability for an attacker to gain arbitrary write access to user-supplied memory addresses.

Q: Is there a workaround for CVE-2014-0038?

There are no known effective workarounds for CVE-2014-0038, so upgrading the kernel is the recommended course of action.

Published Jan 31, 2014

Updated

Linux kernel(>= version 3.4+) built with the X32 ABI for 64-bit mode support CONFIGX86X32, is vulnerable to an arbitrary write to a user supplied address. X32 ABI allows 32-bit programs to run on 64-bit machines with all its features, without using the 64-bit addressing. These programs continue to use 32-bit memory addressing. The flaw occurs while doing a recvmmsg(2) call.

A user/program could use this flaw to crash the system resulting in DoS or potentially escalate user privileges to a system.

Upstream fix: ------------- -> https://git.kernel.org/linus/2def2ef2ae5f3990aabdbe8a755911902707d268

Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/01/31/2

Other sources

The compatsysrecvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIGX86X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.

— MITRE

Affected Software

305 affected components

Linux Linux kernel>=3.4<3.4.79

Linux Linux kernel>=3.5<3.10.29

Linux Linux kernel>=3.11<3.12.10

Linux Linux kernel>=3.13<3.13.2

openSUSE openSUSE=12.3

Linux Linux kernel<=3.13.1

Linux Linux kernel=3.0-rc1

Linux Linux kernel=3.0-rc2

Linux Linux kernel=3.0-rc3

Linux Linux kernel=3.0-rc4

Linux Linux kernel=3.0-rc5

Linux Linux kernel=3.0-rc6

Linux Linux kernel=3.0-rc7

Linux Linux kernel=3.0.1

Linux Linux kernel=3.0.2

Linux Linux kernel=3.0.3

Linux Linux kernel=3.0.4

Linux Linux kernel=3.0.5

Linux Linux kernel=3.0.6

Linux Linux kernel=3.0.7

Linux Linux kernel=3.0.8

Linux Linux kernel=3.0.9

Linux Linux kernel=3.0.10

Linux Linux kernel=3.0.11

Linux Linux kernel=3.0.12

Linux Linux kernel=3.0.13

Linux Linux kernel=3.0.14

Linux Linux kernel=3.0.15

Linux Linux kernel=3.0.16

Linux Linux kernel=3.0.17

Linux Linux kernel=3.0.18

Linux Linux kernel=3.0.19

Linux Linux kernel=3.0.20

Linux Linux kernel=3.0.21

Linux Linux kernel=3.0.22

Linux Linux kernel=3.0.23

Linux Linux kernel=3.0.24

Linux Linux kernel=3.0.25

Linux Linux kernel=3.0.26

Linux Linux kernel=3.0.27

Linux Linux kernel=3.0.28

Linux Linux kernel=3.0.29

Linux Linux kernel=3.0.30

Linux Linux kernel=3.0.31

Linux Linux kernel=3.0.32

Linux Linux kernel=3.0.33

Linux Linux kernel=3.0.34

Linux Linux kernel=3.0.35

Linux Linux kernel=3.0.36

Linux Linux kernel=3.0.37

Linux Linux kernel=3.0.38

Linux Linux kernel=3.0.39

Linux Linux kernel=3.0.40

Linux Linux kernel=3.0.41

Linux Linux kernel=3.0.42

Linux Linux kernel=3.0.43

Linux Linux kernel=3.0.44

Linux Linux kernel=3.0.45

Linux Linux kernel=3.0.46

Linux Linux kernel=3.0.47

Linux Linux kernel=3.0.48

Linux Linux kernel=3.0.49

Linux Linux kernel=3.0.50

Linux Linux kernel=3.0.51

Linux Linux kernel=3.0.52

Linux Linux kernel=3.0.53

Linux Linux kernel=3.0.54

Linux Linux kernel=3.0.55

Linux Linux kernel=3.0.56

Linux Linux kernel=3.0.57

Linux Linux kernel=3.0.58

Linux Linux kernel=3.0.59

Linux Linux kernel=3.0.60

Linux Linux kernel=3.0.61

Linux Linux kernel=3.0.62

Linux Linux kernel=3.0.63

Linux Linux kernel=3.0.64

Linux Linux kernel=3.0.65

Linux Linux kernel=3.0.66

Linux Linux kernel=3.0.67

Linux Linux kernel=3.0.68

Linux Linux kernel=3.1

Linux Linux kernel=3.1-rc1

Linux Linux kernel=3.1-rc2

Linux Linux kernel=3.1-rc3

Linux Linux kernel=3.1-rc4

Linux Linux kernel=3.1.1

Linux Linux kernel=3.1.2

Linux Linux kernel=3.1.3

Linux Linux kernel=3.1.4

Linux Linux kernel=3.1.5

Linux Linux kernel=3.1.6

Linux Linux kernel=3.1.7

Linux Linux kernel=3.1.8

Linux Linux kernel=3.1.9

Linux Linux kernel=3.1.10

Linux Linux kernel=3.2

Linux Linux kernel=3.2-rc2

Linux Linux kernel=3.2-rc3

Linux Linux kernel=3.2-rc4

Linux Linux kernel=3.2-rc5

Linux Linux kernel=3.2-rc6

Linux Linux kernel=3.2-rc7

Linux Linux kernel=3.2.1

Linux Linux kernel=3.2.2

Linux Linux kernel=3.2.3

Linux Linux kernel=3.2.4

Linux Linux kernel=3.2.5

Linux Linux kernel=3.2.6

Linux Linux kernel=3.2.7

Linux Linux kernel=3.2.8

Linux Linux kernel=3.2.9

Linux Linux kernel=3.2.10

Linux Linux kernel=3.2.11

Linux Linux kernel=3.2.12

Linux Linux kernel=3.2.13

Linux Linux kernel=3.2.14

Linux Linux kernel=3.2.15

Linux Linux kernel=3.2.16

Linux Linux kernel=3.2.17

Linux Linux kernel=3.2.18

Linux Linux kernel=3.2.19

Linux Linux kernel=3.2.20

Linux Linux kernel=3.2.21

Linux Linux kernel=3.2.22

Linux Linux kernel=3.2.23

Linux Linux kernel=3.2.24

Linux Linux kernel=3.2.25

Linux Linux kernel=3.2.26

Linux Linux kernel=3.2.27

Linux Linux kernel=3.2.28

Linux Linux kernel=3.2.29

Linux Linux kernel=3.2.30

Linux Linux kernel=3.3

Linux Linux kernel=3.3-rc1

Linux Linux kernel=3.3-rc2

Linux Linux kernel=3.3-rc3

Linux Linux kernel=3.3-rc4

Linux Linux kernel=3.3-rc5

Linux Linux kernel=3.3-rc6

Linux Linux kernel=3.3-rc7

Linux Linux kernel=3.3.1

Linux Linux kernel=3.3.2

Linux Linux kernel=3.3.3

Linux Linux kernel=3.3.4

Linux Linux kernel=3.3.5

Linux Linux kernel=3.3.6

Linux Linux kernel=3.3.7

Linux Linux kernel=3.3.8

Linux Linux kernel=3.4

Linux Linux kernel=3.4-rc1

Linux Linux kernel=3.4-rc2

Linux Linux kernel=3.4-rc3

Linux Linux kernel=3.4-rc4

Linux Linux kernel=3.4-rc5

Linux Linux kernel=3.4-rc6

Linux Linux kernel=3.4-rc7

Linux Linux kernel=3.4.1

Linux Linux kernel=3.4.2

Linux Linux kernel=3.4.3

Linux Linux kernel=3.4.4

Linux Linux kernel=3.4.5

Linux Linux kernel=3.4.6

Linux Linux kernel=3.4.7

Linux Linux kernel=3.4.8

Linux Linux kernel=3.4.9

Linux Linux kernel=3.4.10

Linux Linux kernel=3.4.11

Linux Linux kernel=3.4.12

Linux Linux kernel=3.4.13

Linux Linux kernel=3.4.14

Linux Linux kernel=3.4.15

Linux Linux kernel=3.4.16

Linux Linux kernel=3.4.17

Linux Linux kernel=3.4.18

Linux Linux kernel=3.4.19

Linux Linux kernel=3.4.20

Linux Linux kernel=3.4.21

Linux Linux kernel=3.4.22

Linux Linux kernel=3.4.23

Linux Linux kernel=3.4.24

Linux Linux kernel=3.4.25

Linux Linux kernel=3.4.26

Linux Linux kernel=3.4.27

Linux Linux kernel=3.4.28

Linux Linux kernel=3.4.29

Linux Linux kernel=3.4.30

Linux Linux kernel=3.4.31

Linux Linux kernel=3.4.32

Linux Linux kernel=3.5.1

Linux Linux kernel=3.5.2

Linux Linux kernel=3.5.3

Linux Linux kernel=3.5.4

Linux Linux kernel=3.5.5

Linux Linux kernel=3.5.6

Linux Linux kernel=3.5.7

Linux Linux kernel=3.6

Linux Linux kernel=3.6.1

Linux Linux kernel=3.6.2

Linux Linux kernel=3.6.3

Linux Linux kernel=3.6.4

Linux Linux kernel=3.6.5

Linux Linux kernel=3.6.6

Linux Linux kernel=3.6.7

Linux Linux kernel=3.6.8

Linux Linux kernel=3.6.9

Linux Linux kernel=3.6.10

Linux Linux kernel=3.6.11

Linux Linux kernel=3.7

Linux Linux kernel=3.7.1

Linux Linux kernel=3.7.2

Linux Linux kernel=3.7.3

Linux Linux kernel=3.7.4

Linux Linux kernel=3.7.5

Linux Linux kernel=3.7.6

Linux Linux kernel=3.7.7

Linux Linux kernel=3.7.8

Linux Linux kernel=3.7.9

Linux Linux kernel=3.7.10

Linux Linux kernel=3.8.0

Linux Linux kernel=3.8.1

Linux Linux kernel=3.8.2

Linux Linux kernel=3.8.3

Linux Linux kernel=3.8.4

Linux Linux kernel=3.8.5

Linux Linux kernel=3.8.6

Linux Linux kernel=3.8.7

Linux Linux kernel=3.8.8

Linux Linux kernel=3.8.9

Linux Linux kernel=3.8.10

Linux Linux kernel=3.8.11

Linux Linux kernel=3.8.12

Linux Linux kernel=3.8.13

Linux Linux kernel=3.9-rc1

Linux Linux kernel=3.9-rc2

Linux Linux kernel=3.9-rc3

Linux Linux kernel=3.9-rc4

Linux Linux kernel=3.9-rc5

Linux Linux kernel=3.9-rc6

Linux Linux kernel=3.9-rc7

Linux Linux kernel=3.9.0

Linux Linux kernel=3.9.1

Linux Linux kernel=3.9.2

Linux Linux kernel=3.9.3

Linux Linux kernel=3.9.4

Linux Linux kernel=3.9.5

Linux Linux kernel=3.9.6

Linux Linux kernel=3.9.7

Linux Linux kernel=3.9.8

Linux Linux kernel=3.9.9

Linux Linux kernel=3.9.10

Linux Linux kernel=3.9.11

Linux Linux kernel=3.10

Linux Linux kernel=3.10.1

Linux Linux kernel=3.10.2

Linux Linux kernel=3.10.3

Linux Linux kernel=3.10.4

Linux Linux kernel=3.10.5

Linux Linux kernel=3.10.6

Linux Linux kernel=3.10.7

Linux Linux kernel=3.10.8

Linux Linux kernel=3.10.9

Linux Linux kernel=3.10.10

Linux Linux kernel=3.10.11

Linux Linux kernel=3.10.12

Linux Linux kernel=3.10.13

Linux Linux kernel=3.10.14

Linux Linux kernel=3.10.15

Linux Linux kernel=3.10.16

Linux Linux kernel=3.10.17

Linux Linux kernel=3.10.18

Linux Linux kernel=3.10.19

Linux Linux kernel=3.10.20

Linux Linux kernel=3.10.21

Linux Linux kernel=3.10.22

Linux Linux kernel=3.10.23

Linux Linux kernel=3.10.24

Linux Linux kernel=3.10.25

Linux Linux kernel=3.10.26

Linux Linux kernel=3.10.27

Linux Linux kernel=3.10.28

Linux Linux kernel=3.10.29

Linux Linux kernel=3.11

Linux Linux kernel=3.11.1

Linux Linux kernel=3.11.2

Linux Linux kernel=3.11.3

Linux Linux kernel=3.11.4

Linux Linux kernel=3.11.5

Linux Linux kernel=3.11.6

Linux Linux kernel=3.11.7

Linux Linux kernel=3.11.8

Linux Linux kernel=3.11.9

Linux Linux kernel=3.11.10

Linux Linux kernel=3.12

Linux Linux kernel=3.12.1

Linux Linux kernel=3.12.2

Linux Linux kernel=3.12.3

Linux Linux kernel=3.12.4

Linux Linux kernel=3.12.5

Linux Linux kernel=3.12.6

Linux Linux kernel=3.12.7

Linux Linux kernel=3.12.8

Linux Linux kernel=3.12.9

Linux Linux kernel=3.12.10

Linux Linux kernel=3.13

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 3.13.2

Event History

Jan 31, 2014

Data Sourced

via Red Hat·09:35 AM

DescriptionSeverityAffected Software

Feb 6, 2014

CVE Published

via MITRE·10:00 PM

Data Sourced

via MITRE·10:00 PM

Description

Data Sourced

via NVD·10:55 PM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What is the severity of CVE-2014-0038?

CVE-2014-0038 has been rated as having high severity due to the potential for arbitrary write to a user-supplied address.

How do I fix CVE-2014-0038?

To fix CVE-2014-0038, users should update their Linux kernel to a version that is not affected by the vulnerability.

What software versions are affected by CVE-2014-0038?

CVE-2014-0038 affects Linux kernel versions between 3.4 and 3.13.1, particularly those built with the X32 ABI.

What is the impact of CVE-2014-0038?

The impact of CVE-2014-0038 includes the ability for an attacker to gain arbitrary write access to user-supplied memory addresses.

Is there a workaround for CVE-2014-0038?

There are no known effective workarounds for CVE-2014-0038, so upgrading the kernel is the recommended course of action.

CVE-2014-0038: Input Validation

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

What is the severity of CVE-2014-0038?

How do I fix CVE-2014-0038?

What software versions are affected by CVE-2014-0038?

What is the impact of CVE-2014-0038?

Is there a workaround for CVE-2014-0038?

Company

Resources

Contact