CVE-2014-2851: Use After Free
A flaw was found in the way pinginitsock() function handled groupinfo struct reference counter. Since groupinfo refcounter is only incremented but never decremented in this codepath, it could lead to refcounter overflow and possibly to use-after-free issue later.
An unprivileged local user could use this flaw to crash the system or, potentially, escalate their privileges on the system.
Upstream patch proposal: https://lkml.org/lkml/2014/4/10/736
Other sources
Integer overflow in the pinginitsock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
Linux kernel (net/ipv4/ping.c)to a version that resolves this vulnerability.Fixed in 3.14.1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2851?
CVE-2014-2851 is classified as a medium severity vulnerability due to potential use-after-free issues.
How do I fix CVE-2014-2851?
To fix CVE-2014-2851, update your Linux kernel to version 5.10.223-1 or later.
What systems are affected by CVE-2014-2851?
CVE-2014-2851 affects numerous Linux kernel versions from 3.0 up to 3.14.1.
Can CVE-2014-2851 be exploited remotely?
CVE-2014-2851 requires local access, so it cannot be exploited remotely by an attacker.
Is there a known attack vector for CVE-2014-2851?
The attack vector for CVE-2014-2851 involves unprivileged local users exploiting the vulnerability to cause a denial of service.