CVE-2014-0069: Buffer Overflow
A flaw was found in the way cifs handled iovecs with bogus pointers userland passed down via writev() during uncached writes.
An unprivileged local user with access to cifs share could use this flaw to crash the system or leak kernel memory. Privilege escalation cannot be ruled out (since memory corruption is involved), but is unlikely.
The default cache settings for cifs mounts on Red Hat Enterprise Linux prohibit successful exploitation of this issue.
Acknowledgements:
Red Hat would like to thank Al Viro for reporting this issue.
Other sources
The cifsiovecwrite function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0069?
CVE-2014-0069 is considered a high-severity vulnerability due to its potential to crash the system or leak sensitive kernel memory.
How do I fix CVE-2014-0069?
To mitigate CVE-2014-0069, users should upgrade to a patched version of the Linux Kernel, specifically versions 5.10.223-1 or newer.
Who is affected by CVE-2014-0069?
CVE-2014-0069 affects installations of the Linux Kernel up to version 3.13.5, along with certain versions of SUSE and Red Hat Enterprise Linux.
Can CVE-2014-0069 lead to privilege escalation?
Yes, while the primary concern with CVE-2014-0069 is system crashes and memory leaks, privilege escalation cannot be ruled out.
How does CVE-2014-0069 work?
CVE-2014-0069 exploits a flaw in the way the CIFS protocol handles iovecs with invalid pointers during uncached writes.