CVE-2014-3917: Infoleak
kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIGAUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.
Other sources
Linux kernel built with the system-call auditing support(CONFIGAUDITSYSCALL) is vulnerable to a kernel crash or information disclosure flaw caused by out of bounds memory access. It could occur when system call audit rules are configured on a system. Administrative privileges are required to add such audit rules.
When system call audit rules are present on a system, an unprivileged user/program could use this flaw to leak kernel memory bytes or crash the system resulting DoS.
Upstream fix: ------------- -> http://article.gmane.org/gmane.linux.kernel/1713179
References: ----------- -> http://seclists.org/oss-sec/2014/q2/377
— Red Hat
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-3917?
CVE-2014-3917 is considered a moderate severity vulnerability that can lead to information disclosure or denial of service.
How do I fix CVE-2014-3917?
To fix CVE-2014-3917, update to a version of the Linux kernel that is later than 3.14.5 or apply the recommended patches provided by your Linux distribution.
Who is affected by CVE-2014-3917?
CVE-2014-3917 affects local users on systems running specific versions of the Linux kernel up to 3.14.5 with CONFIG_AUDITSYSCALL enabled.
What are the potential impacts of CVE-2014-3917?
The potential impacts of CVE-2014-3917 include local users obtaining sensitive information from kernel memory or causing a system crash.
Is CVE-2014-3917 exploitable remotely?
No, CVE-2014-3917 is not remotely exploitable as it requires local access to the vulnerable system.