CVE-2014-7970: Medium severity suse linux enterprise server vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the VFS and user name-space support(CONFIGUSERNS) is vulnerable to a potential DoS flaw. It could occur while doing pivotroot(2) call to change root file system.
A privileged user/process could use this flaw to potentially render a system unusable leading to DoS.
Upstream fix: ------------- -> http://thread.gmane.org/gmane.linux.file-systems/89076
Reference: ---------- -> http://seclists.org/oss-sec/2014/q4/228
— Red Hat
The pivotroot implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivotroot system call.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-7970?
CVE-2014-7970 has a potential impact resulting in a denial of service (DoS) that could make the system unusable.
How do I fix CVE-2014-7970?
To fix CVE-2014-7970, upgrade to the latest versions of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.119-1, 6.1.123-1, 6.12.11-1, or 6.12.12-1.
Which systems are affected by CVE-2014-7970?
CVE-2014-7970 affects SUSE Linux Enterprise Server 11.0 SP3, Linux kernel versions up to 3.17, and Ubuntu Linux versions 12.04 and 14.04.
Who can exploit CVE-2014-7970?
A privileged user or process can exploit CVE-2014-7970 to execute a potential denial of service attack.
What is the specific attack vector for CVE-2014-7970?
The specific attack vector for CVE-2014-7970 involves performing a pivot_root(2) call to change the root filesystem.