CVE-2014-4699: Race Condition
It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space. A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system. Note: The CVE-2014-4699 issue only affected systems using an Intel CPU.
Other sources
On Intel CPUs sysret to non-canonical address causes a fault on the sysret instruction itself after the stack pointer is set to user mode provided value but before the CPL is changed. Systems running on AMD CPUs are not vulnerable to this issue as sysret on AMD CPUs does not generate a fault before the CPL change.
It was found that certain Linux kernel's ptrace subsystem code paths allow the tracer to set tracee's instruction pointer to non-canonical address which is later used on tracee's return to user mode via the sysret instruction, effectively bypassing the hardening introduced via the fixes for CVE-2005-1764 (introduced guard page between the end of the user-mode accessible virtual address space and the beginning of the non-canonical) and CVE-2006-0744 (system call handler hardening).
An unprivileged local user could use this flaw to increase their privileges on the system.
Upstream fix: ------------- -> https://git.kernel.org/linus/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a
— Red Hat
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-4699?
The severity of CVE-2014-4699 is considered high due to its potential to allow local unprivileged users to crash the system.
How do I fix CVE-2014-4699?
To fix CVE-2014-4699, you should update your Linux kernel to the recommended versions provided by your distribution, such as 0:2.6.32-431.20.5.el6 for RedHat.
What versions of the Linux kernel are affected by CVE-2014-4699?
CVE-2014-4699 affects multiple versions of the Linux kernel, specifically versions before 3.15.4 and various specific versions listed by RedHat and Debian.
Can CVE-2014-4699 be exploited remotely?
No, CVE-2014-4699 requires local access, making it less likely to be exploited remotely.
What systems are impacted by CVE-2014-4699?
CVE-2014-4699 impacts systems running vulnerable versions of the Linux kernel, including those from RedHat, Debian, and Ubuntu distributions.