CVE-2014-4943: Medium severity linux kernel vulnerability
A flaw was found in the way pppol2tpsetsockopt() and pppol2tpgetsockopt() functions in the Linux kernel's PPP over L2TP implementation handled non-SOLPPPOL2TP level.
A local, unprivileged user could use this flaw to escalate their privileges on the system.
Acknowledgements:
Red Hat would like to thank Sasha Levin for reporting this issue.
Other sources
The PPPoL2TP feature in net/l2tp/l2tpppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-4943?
CVE-2014-4943 is classified as a high severity vulnerability due to its potential to allow local unprivileged users to escalate their privileges.
How do I fix CVE-2014-4943?
To fix CVE-2014-4943, update the Linux kernel to a version that includes the security patch addressing this vulnerability.
Which Linux kernel versions are affected by CVE-2014-4943?
CVE-2014-4943 affects Linux kernel versions from 2.6.23 up to 3.15.6 as well as specific distributions such as openSUSE and SUSE Enterprise Linux.
Can exploitation of CVE-2014-4943 be prevented?
Exploitation of CVE-2014-4943 can be mitigated by ensuring that only authorized users are allowed to access the system and keeping the Linux kernel updated.
What components are implicated in CVE-2014-4943?
CVE-2014-4943 primarily concerns the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation.