CVE-2014-6410: Medium severity linux kernel vulnerability
A stack overflow flaw caused by infinite recursion was found in the way the Linux kernel's Universal Disk Format (UDF) file system implementation processed indirect Information Control Blocks (ICBs). An attacker with physical access to the system could use a specially crafted UDF image to crash the system.
Other sources
Linux kernel built with the UDF file system support(CONFIGUDFFS) is vulnerable to a crash due to stack overflow through infinite recursion. It occurs while traversing a long ICB hierarchy.
a user/program able to mount such a file system could use this flaw to crash the system kernel resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/c03aa9f6e1f938618e6db2e23afef0574efeeb65
Reference: ---------- -> http://seclists.org/oss-sec/2014/q3/600
— Red Hat
The udfreadinode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.
Affected Software
Remediation
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-6410?
CVE-2014-6410 has been categorized as a high severity vulnerability due to its potential to cause a stack overflow and disrupt system stability.
How do I fix CVE-2014-6410?
To fix CVE-2014-6410, upgrade to the patched kernel versions provided by your Linux distribution, such as Red Hat or Debian.
What systems are affected by CVE-2014-6410?
CVE-2014-6410 primarily affects Linux kernel versions prior to 3.16.3 and various specific distributions like Red Hat and Debian.
What type of attack can exploit CVE-2014-6410?
CVE-2014-6410 can be exploited by an attacker with physical access to the system using a specially crafted UDF image.
Is there a workaround for CVE-2014-6410?
Currently, the recommended solution for CVE-2014-6410 is to apply the necessary kernel updates rather than seeking a workaround.