CVE-2014-2568: Use After Free
An information leak flaw was found in the way skbzerocopy() copied skbs that are backed by userspace buffers (for example vhost-net and recent xen netback). Once the source skb is consumed, ubuf destructor is called and potentially releases the corresponding userspace buffers, which can then for example be repurposed, while the destination skb is still pointing to the them.
Upstream patch: https://lkml.org/lkml/2014/3/20/421
Other sources
Use-after-free vulnerability in the nfqnlzcopy function in net/netfilter/nfnetlinkqueuecore.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skbzerocopy function in net/core/skbuff.c before the vulnerability was announced.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
redhat/kernelto a version that resolves this vulnerability.Fixed in 0:3.10.0-123.4.2.el7 - Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2568?
CVE-2014-2568 is classified as a medium severity vulnerability due to its potential for information leakage in user-space memory.
How do I fix CVE-2014-2568?
To fix CVE-2014-2568, you should upgrade to kernel version 0:3.10.0-123.4.2.el7 or later for Red Hat systems.
What versions of the Linux kernel are affected by CVE-2014-2568?
CVE-2014-2568 affects Linux kernel versions from 3.0 to 3.13.6 inclusive.
Which Linux distributions are impacted by CVE-2014-2568?
CVE-2014-2568 affects Red Hat, Ubuntu 14.04, and Debian-based systems with specific kernel versions.
Is CVE-2014-2568 related to userspace buffer handling?
Yes, CVE-2014-2568 involves an information leak due to the handling of userspace buffers in skb_zerocopy().