CVE-2014-2885: Integer Overflow
Multiple integer overflows in TrueCrypt 7.1a allow local users to (1) obtain sensitive information via vectors involving a crafted item->OriginalLength value in the MainThreadProc function in EncryptedIoQueue.c or (2) cause a denial of service (memory consumption) via vectors involving large StartingOffset and Length values in the ProcessVolumeDeviceControlIrp function in Ntdriver.c.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-2885?
CVE-2014-2885 has a severity rating classified as medium due to the potential for denial of service and information disclosure.
How do I fix CVE-2014-2885?
The best fix for CVE-2014-2885 is to upgrade to a version of TrueCrypt that does not have the vulnerabilities, although TrueCrypt development has ceased.
What types of attacks does CVE-2014-2885 allow?
CVE-2014-2885 allows for local users to exploit integer overflows for sensitive information disclosure and denial of service through memory consumption.
Who is affected by CVE-2014-2885?
CVE-2014-2885 affects users of TrueCrypt version 7.1a, particularly those running it on local systems.
What impact can CVE-2014-2885 have on my system?
CVE-2014-2885 can lead to memory issues that may cause applications to crash or hang, impacting overall system stability.