First published: Wed May 07 2014(Updated: )
A flaw was found in the way the Linux kernel's floppy driver handled user space provided data in certain error code paths while processing FDRAWCMD IOCTL commands. A local user with write access to /dev/fdX could use this flaw to free (using the kfree() function) arbitrary kernel memory. (CVE-2014-1737, Important) It was found that the Linux kernel's floppy driver leaked internal kernel memory addresses to user space during the processing of the FDRAWCMD IOCTL command. A local user with write access to /dev/fdX could use this flaw to obtain information about the kernel heap arrangement. (CVE-2014-1738, Low) Note: A local user with write access to /dev/fdX could use these two flaws (CVE-2014-1737 in combination with CVE-2014-1738) to escalate their privileges on the system.
Credit: chrome-cve-admin@google.com cve-coordination@google.com
Affected Software | Affected Version | How to fix |
---|---|---|
redhat/kernel | <0:2.6.18-371.9.1.el5 | 0:2.6.18-371.9.1.el5 |
redhat/kernel | <0:2.6.18-238.53.1.el5 | 0:2.6.18-238.53.1.el5 |
redhat/kernel | <0:2.6.18-348.27.1.el5 | 0:2.6.18-348.27.1.el5 |
redhat/kernel | <0:2.6.32-431.20.3.el6 | 0:2.6.32-431.20.3.el6 |
redhat/kernel | <0:2.6.32-220.52.1.el6 | 0:2.6.32-220.52.1.el6 |
redhat/kernel | <0:2.6.32-358.46.1.el6 | 0:2.6.32-358.46.1.el6 |
redhat/kernel | <0:3.10.0-123.4.2.el7 | 0:3.10.0-123.4.2.el7 |
redhat/kernel-rt | <0:3.10.33-rt32.34.el6 | 0:3.10.33-rt32.34.el6 |
Linux Linux kernel | <=3.14.3 | |
Redhat Enterprise Linux Eus | =5.6 | |
Redhat Enterprise Linux Eus | =6.3 | |
Debian Debian Linux | =6.0 | |
Debian Debian Linux | =7.0 | |
Oracle Linux | =5 | |
Oracle Linux | =6 | |
SUSE Linux Enterprise Desktop | =11-sp3 | |
Suse Linux Enterprise High Availability Extension | =11-sp3 | |
Suse Linux Enterprise Real Time Extension | =11-sp3 | |
SUSE Linux Enterprise Server | =11-sp3 | |
Suse Linux Enterprise Server | =11-sp3 | |
debian/linux | 5.10.223-1 5.10.226-1 6.1.115-1 6.1.119-1 6.11.10-1 6.12.3-1 |
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
(Appears in the following advisories)