CVE-2014-2038: Infoleak
It was found that cached page was not up-to-date in certain cases when we were extending write to cover the full page and thus contained uninitalized data.
A local user with write access to file on nfs share could use this flaw to leak kernel memory.
Please note that apart from having security consequences (data leak), this bug is also a data corruptor.
Introduced by: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=c7559663
Upstream fix: https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=263b4509
Other sources
The nfscanextendwrite function in fs/nfs/write.c in the Linux kernel before 3.13.3 relies on a write delegation to extend a write operation without a certain up-to-date verification, which allows local users to obtain sensitive information from kernel memory in opportunistic circumstances by writing to a file in an NFS filesystem and then reading the same file.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
linux kernel (fs/nfs/write.c nfs_can_extend_write)to a version that resolves this vulnerability.Fixed in 3.13.3 - Compensating control
If you cannot immediately patch, reduce exposure by preventing untrusted/local users from having write access to files on NFS shares (since the flaw requires local write access to a file on an NFS filesystem).
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2038?
CVE-2014-2038 has a medium severity rating as it allows local users to leak kernel memory.
How do I fix CVE-2014-2038?
To fix CVE-2014-2038, upgrade to a patched version of the Linux kernel or the relevant Debian package.
Which systems are affected by CVE-2014-2038?
CVE-2014-2038 affects various versions of the Linux kernel prior to 3.13.3 and certain Ubuntu releases.
Can a remote attacker exploit CVE-2014-2038?
No, CVE-2014-2038 can only be exploited by local users who have write access to specific files on an NFS share.
What are the potential impacts of CVE-2014-2038?
The potential impacts of CVE-2014-2038 include unauthorized disclosure of sensitive kernel memory data.