CVE-2014-4014: Medium severity Google Android vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the user namespaces(CONFIGUSERNS) is vulnerable to a potential privilege escalation flaw.
An unprivileged user/process could use this flaw to escalate their privileges on a system.
Upstream fix: ------------- -> https://git.kernel.org/linus/23adbe12ef7d3d4195e80800ab36b37bee28cd03
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/06/10/4
— Red Hat
The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4014?
CVE-2014-4014 has a medium severity rating due to its potential for privilege escalation.
How do I fix CVE-2014-4014?
To fix CVE-2014-4014, update your Linux kernel to version 3.14.8 or later, or apply the relevant patches as specified by your distribution.
Who is affected by CVE-2014-4014?
CVE-2014-4014 affects Linux kernels that have user namespaces functionality enabled, including various versions of Google Android.
Can CVE-2014-4014 be exploited remotely?
CVE-2014-4014 typically requires local access to the system to exploit, as it involves privilege escalation for unprivileged users.
What is the impact of CVE-2014-4014?
The impact of CVE-2014-4014 allows unprivileged users to potentially escalate their privileges, posing a serious security risk.