CVE-2014-2523: Input Validation
Description of the problem:
Some occurences in the netfilter tree use skbheaderpointer() in the following way ...
struct dccphdr dh, dh; ... skbheaderpointer(skb, dataoff, sizeof(dh), &dh);
... where dh itself is a pointer that is being passed as the copy buffer. Instead, we need to use &dh as the forth argument so that we're copying the data into an actual buffer that sits on the stack.
A remote attacker could use this flaw to crash the system or, potentially, escalate their privileges on the system.
References: http://www.openwall.com/lists/oss-security/2014/03/17/3
Introduced by: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=2bc780499aa3
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b22f5126a24b
Other sources
net/netfilter/nfconntrackprotodccp.c in the Linux kernel through 3.13.6 uses a DCCP header pointer incorrectly, which allows remote attackers to cause a denial of service (system crash) or possibly execute arbitrary code via a DCCP packet that triggers a call to the (1) dccpnew, (2) dccppacket, or (3) dccperror function.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2523?
CVE-2014-2523 is classified as a medium severity vulnerability that can potentially lead to a denial of service due to incorrect handling of memory in the netfilter tree.
How do I fix CVE-2014-2523?
To fix CVE-2014-2523, you should upgrade your Linux Kernel to a version that is not affected, specifically versions later than 3.13.9 or any fixed package version like 5.10.223-1.
What versions of the Linux Kernel are affected by CVE-2014-2523?
CVE-2014-2523 affects Linux Kernel versions from 3.2.57 up to 3.13.9 and includes several versions in between.
Is Ubuntu Linux affected by CVE-2014-2523?
Yes, Ubuntu Linux version 10.04 is affected by CVE-2014-2523 and requires updating to a patched kernel version.
What components are involved in CVE-2014-2523?
CVE-2014-2523 involves the skb_header_pointer function within the netfilter tree, which improperly manages memory pointers.