CVE-2014-0196: Linux Kernel Race Condition Vulnerability
It is unexpected and not allowed to call TTY buffer helpers like ttyinsertflipstring concurrently. This may lead to crashes when ECHOing is enabled and concurrect writers call ptywrite in the meantime. In that case the two writers: the ECHOing from a workqueue and ptywrite from the process race and can overflow the corresponding TTY buffer.
An unprivileged local user could use this flaw to crash the system or, potentially, escalate their privileges on the system.
References: http://seclists.org/oss-sec/2014/q2/243
Other sources
Linux Kernel contains a race condition vulnerability within the nttywrite function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
— CISA
The nttywrite function in drivers/tty/ntty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-358.6.1.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-220.51.1.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:2.6.32-279.43.2.el6 - Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-123.1.2.el7 - Upgrade
Upgrade
redhat/kernel-rtto a version that resolves this vulnerability.Fixed in 0:3.10.33-rt32.34.el6 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
If the impacted product/version is still in use and is end-of-life, disconnect it from the network to reduce exposure.
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-0196?
CVE-2014-0196 has been assigned a moderate severity rating due to its potential to cause crashes under specific conditions.
How do I fix CVE-2014-0196?
To fix CVE-2014-0196, update the kernel to versions 2.6.32-358.6.1.el6 or later, or to any fixed 3.x version as specified in vendor patches.
What platforms are affected by CVE-2014-0196?
CVE-2014-0196 affects various Linux kernel versions, particularly those from Red Hat, Debian, and Ubuntu distributions.
Can CVE-2014-0196 be exploited remotely?
CVE-2014-0196 may be exploited locally under certain conditions but is not considered to be directly exploitable remotely.
What symptoms might indicate an issue caused by CVE-2014-0196?
Symptoms of CVE-2014-0196 may include unexpected crashes or instability in systems utilizing concurrent writing to TTY devices.