CVE-2014-2678: Null Pointer Dereference
Last updated 24 July 2024
Other sources
The rdsiwladdrcheck function in net/rds/iw.c in the Linux kernel th ...
— Debian
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Compensating control
On Linux systems that lack RDS transports, prevent use of RDS sockets by blocking bind calls for RDS sockets (e.g., via network/app-level controls or syscall filtering) to mitigate denial-of-service risk described for rds_iw_laddr_check in net/rds/iw.c through Linux kernel 3.14.
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2678?
CVE-2014-2678 has been classified as a high-severity vulnerability due to its potential to cause denial of service through system crashes.
How do I fix CVE-2014-2678?
The fix for CVE-2014-2678 involves upgrading to secure versions of the Linux kernel released after 3.14 or applying specific patches.
Which Linux versions are affected by CVE-2014-2678?
CVE-2014-2678 affects the Linux kernel versions up to and including 3.14.
Can CVE-2014-2678 be exploited remotely?
CVE-2014-2678 requires local user access to exploit the vulnerability.
What impact does CVE-2014-2678 have on a system?
The impact of CVE-2014-2678 includes local denial of service due to a NULL pointer dereference leading to a system crash.