CVE-2014-1737: High severity Linux Linux kernel vulnerability
A flaw was found in the way Linux kernel's floppy driver treated userspace provided data in certain error code path while processing FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to kfree() arbitrary data. (CVE-2014-1737)
It was found that Linux kernel's floppy driver leaked internal kernel memory addresses to userspace during processing of FDRAWCMD ioctl command. An local user with write access to /dev/fdX could use this flaw to get information about kernel heap arrangment. (CVE-2014-1738)
An local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Matthew Daley for reporting these issues.
Other sources
A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important) It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low) Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.
The rawcmdcopyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-1737?
CVE-2014-1737 has been classified with a moderate severity level due to its potential for local privilege escalation.
How do I fix CVE-2014-1737?
To fix CVE-2014-1737, update the kernel to one of the recommended remedied versions listed in the advisory.
Which versions of the Linux kernel are affected by CVE-2014-1737?
Linux kernel versions prior to 3.10.0-123.4.2.el7 are affected by CVE-2014-1737.
Who can exploit CVE-2014-1737?
A local user with write access to /dev/fdX can potentially exploit CVE-2014-1737.
What is the impact of CVE-2014-1737?
The impact of CVE-2014-1737 could allow a local user to free arbitrary memory, leading to potential system instability or local privilege escalation.