CVE-2014-1446: Low severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the YAM modem driver for AX.25(CONFIGYAM) is vulnerable to an information leakage flaw. It could occur while doing an ioctl(SIOCYAMGCFG) call.
A user/program with CAPNETADMIN privileges could use this flaw to leak (four)kernel memory bytes.
Upstream fix: ------------- -> https://git.kernel.org/linus/8e3fbf870481eb53b2d3a322d1fc395ad8b367ed
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/01/15/3
— Red Hat
The yamioctl function in drivers/net/hamradio/yam.c in the Linux kernel before 3.12.8 does not initialize a certain structure member, which allows local users to obtain sensitive information from kernel memory by leveraging the CAPNETADMIN capability for an SIOCYAMGCFG ioctl call.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
Linux kernel (CONFIG_YAM / YAM modem driver for AX.25)to a version that resolves this vulnerability.Fixed in 3.12.8 - Compensating control
If upgrading is not immediately possible, restrict CAP_NET_ADMIN capability so that untrusted local users/programs cannot issue the SIOCYAMGCFG ioctl call (the flaw is triggered via an ioctl(SIOCYAMGCFG) call in yam_ioctl).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-1446?
CVE-2014-1446 has been classified as a medium severity vulnerability due to the potential for information leakage.
How do I fix CVE-2014-1446?
To fix CVE-2014-1446, upgrade the Linux kernel to version 5.10.223-1 or later.
Who is affected by CVE-2014-1446?
CVE-2014-1446 affects users of the Linux kernel version 3.12 and earlier, particularly those using the YAM modem driver.
What type of vulnerability is CVE-2014-1446?
CVE-2014-1446 is an information leakage vulnerability that can reveal kernel memory bytes through specific ioctl calls.
What permissions are required to exploit CVE-2014-1446?
Exploitation of CVE-2014-1446 requires CAP_NET_ADMIN privileges.