CVE-2014-0131: Use After Free
An information leak flaw was found in the way way segmentation was performed on skbs originated from vhost-net when zerocopy feature was enabled. Once the source skb is consumed, ubuf destructor is called and potentially releases the corresponding userspace buffers, which can then for example be repurposed, while the destination skb could still be pointing to the them.
Acknowledgements:
This issue was discovered by Michael S. Tsirkin of Red Hat.
Other sources
Use-after-free vulnerability in the skbsegment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1 - Upgrade
Upgrade
linux kernelto a version that resolves this vulnerability.Fixed in 3.13.6 - Compensating control
Disable the zerocopy feature to prevent the skbs segmented from vhost-net (where segmentation is performed on skbs originated from vhost-net) from triggering the information leak when the vulnerability conditions are met.
- Compensating control
Apply the missing orphaning operation described as absent in the skb_segment function in net/core/skbuff.c to prevent the use-after-free that can expose kernel memory.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-0131?
CVE-2014-0131 is classified as a high severity vulnerability due to information leakage risks.
How do I fix CVE-2014-0131?
To fix CVE-2014-0131, upgrade your Linux kernel to one of the patched versions such as 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2014-0131?
CVE-2014-0131 affects various Linux distributions including Debian, openSUSE, and SUSE Linux Enterprise Server.
Is there a workaround for CVE-2014-0131?
Currently, disabling the zerocopy feature can serve as a temporary workaround for CVE-2014-0131.
What type of vulnerability is CVE-2014-0131?
CVE-2014-0131 is classified as an information leak vulnerability related to segmentation issues in the Linux kernel.