CVE-2014-4171: Race Condition
Last updated 24 July 2024
Other sources
Linux kernel built with the shared memory support is vulnerable to a denial of service flaw caused by a race condition in mmap access to a hole, while it is punched from shmem and madvise(2) & fallocate(2) calls. In that mmap access could prevent the other calls from completing.
A user/process could use this flaw to cause a DoS.
Upstream fixes: ------------- -> https://git.kernel.org/linus/f00cdc6df7d7cfcabb5b740911e6788cb0802bdb -> https://git.kernel.org/linus/8e205f779d1443a94b5ae81aa359cb535dd3021e -> https://git.kernel.org/linus/b1a366500bd537b50c3aad26dc7df083ec03a448
Reference: ---------- -> http://www.openwall.com/lists/oss-security/2014/06/18/11
— Red Hat
mm/shmem.c in the Linux kernel through 3.15.1 does not properly implement the interaction between range notification and hole punching, which allows local users to cause a denial of service (imutex hold) by using the mmap system call to access a hole, as demonstrated by interfering with intended shmem activity by blocking completion of (1) an MADVREMOVE madvise call or (2) an FALLOCFLPUNCHHOLE fallocate call.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4171?
CVE-2014-4171 has been assigned a moderate severity rating due to its potential for denial of service.
How do I fix CVE-2014-4171?
To mitigate CVE-2014-4171, update the Linux kernel to versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of the Linux kernel are affected by CVE-2014-4171?
CVE-2014-4171 affects Linux kernels up to version 3.15.1.
Is CVE-2014-4171 specific to any Linux distributions?
Yes, CVE-2014-4171 specifically affects Ubuntu Linux 12.04 and various Linux kernel versions.
What type of vulnerability is CVE-2014-4171?
CVE-2014-4171 is classified as a denial of service vulnerability resulting from a race condition in mmap access.