CVE-2014-5045: Use After Free
A flaw was found in the way reference counting was handled in the Linux kernel's VFS subsystem when unmount on symlink was performed.
On Red Hat Enterprise Linux 6 an unprivileged local user could use this flaw to cause OOM conditions leading to denial of service or, potentially, trigger use-after-free error.
On Red Hat Enterprise Linux 7 a privileged local user with CAPSYSADMIN capability (also in a container) could use this flaw to cause OOM conditions leading to denial of service or, potentially, trigger use-after-free error.
Acknowledgements:
Red Hat would like to thank Vasily Averin of Parallels for reporting this issue.
Other sources
A flaw was found in the way the Linux kernel's VFS subsystem handled reference counting when performing unmount operations on symbolic links. A local, unprivileged user could use this flaw to exhaust all available memory on the system or, potentially, trigger a use-after-free error, resulting in a system crash or privilege escalation.
The mountpointlast function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.
Affected Software
Remediation
Patch Available
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-5045?
CVE-2014-5045 has a severity rating that indicates it could lead to Out of Memory (OOM) conditions and a potential denial of service.
How do I fix CVE-2014-5045?
To fix CVE-2014-5045, upgrade your kernel to the fixed versions provided by Red Hat or Debian as noted in the vulnerability details.
Who is affected by CVE-2014-5045?
CVE-2014-5045 affects unprivileged local users on Red Hat Enterprise Linux 6 who can exploit the flaw in the kernel's VFS subsystem.
What versions are vulnerable to CVE-2014-5045?
Vulnerable versions of the Linux kernel include versions prior to 2.6.32-504.el6 and specific Debian kernel versions listed in the vulnerability details.
Is there a patch available for CVE-2014-5045?
Yes, patches for CVE-2014-5045 are available as kernel updates from Red Hat and Debian.