CVE-2014-1445: Low severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with a driver for wanXL PCI cards by SBE Inc.(CONFIGWANXL) is vulnerable to an information leakage flaw. This could occur while doing an ioctl(2) call.
A user/program could use this flaw to leak (two)kernel memory bytes.
Upstream fix: ------------- -> https://git.kernel.org/linus/2b13d06c9584b4eb773f1e80bbaedab9a1c344e1
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/01/15/3
— Red Hat
The wanxlioctl function in drivers/net/wan/wanxl.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory via an ioctl call.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.116-1Fixed in 7.2.15-1Fixed in 7.3.3-1 - Upgrade
Upgrade
Linux kernel (CONFIG_WANXL)to a version that resolves this vulnerability.Fixed in 3.11.7 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Patch 2b13d06c9584b4eb773f1e80bbaedab9a1c344e1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1445?
CVE-2014-1445 has been classified as a low severity vulnerability due to its potential for information leakage.
How do I fix CVE-2014-1445?
To fix CVE-2014-1445, you should upgrade the Linux kernel to version 3.11.7 or newer.
Which versions of the Linux kernel are affected by CVE-2014-1445?
CVE-2014-1445 affects the Linux kernel versions up to and including 3.11.6.
What is the nature of the vulnerability in CVE-2014-1445?
CVE-2014-1445 is an information leakage flaw that allows users to leak kernel memory bytes during an ioctl(2) call.
Are any specific distributions impacted by CVE-2014-1445?
Various distributions using a vulnerable version of the Linux kernel, particularly those that use driver support for wanXL PCI cards, are impacted by CVE-2014-1445.