CVE-2014-3153: Linux Kernel Privilege Escalation Vulnerability
A flaw was found in the way pi to pi futex requeueing was handled.
A local unprivileged user can use this flaw to increase their privileges on the system.
Other sources
The futexrequeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
— CISA
The futexrequeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEXREQUEUE command that facilitates unsafe waiter modification.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3153?
CVE-2014-3153 is rated as a high-severity vulnerability due to its potential to allow local unprivileged users to escalate privileges.
How do I fix CVE-2014-3153?
To fix CVE-2014-3153, update the Linux kernel to a version that is not affected, such as any version after 3.14.6.
What systems are affected by CVE-2014-3153?
CVE-2014-3153 affects multiple versions of the Linux kernel, including versions up to 3.14.6 and certain distributions like Ubuntu 12.04 and Red Hat Enterprise Linux 6.2.
Can CVE-2014-3153 be exploited remotely?
No, CVE-2014-3153 can only be exploited locally by an unprivileged user on the affected system.
What is the impact of exploiting CVE-2014-3153?
Exploitation of CVE-2014-3153 allows an attacker to increase their privileges on the system, potentially leading to unauthorized access and control.