CVE-2014-8121: Medium severity suse linux enterprise desktop vulnerability
DBLOOKUP in nssfiles/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
Other sources
IssueDescription:
The "files" backend for the Name Service Switch (NSS) in glibc does not properly isolate iteration over the entire database from key-based lookups. As a result, an application which performs lookups on a database while iterating over it could enter an infinite loop, leading to a denial of service.
Acknowledgements:
This issue was discovered by Robin Hack of Red Hat.
— Red Hat
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8121?
CVE-2014-8121 has a medium severity level as it can lead to a denial of service due to an infinite loop.
How do I fix CVE-2014-8121?
To mitigate CVE-2014-8121, update glibc to version 2.22 or later, or apply patches provided by your Linux distribution.
What are the affected systems for CVE-2014-8121?
CVE-2014-8121 affects several versions of SUSE Linux Enterprise Desktop, SUSE Linux Enterprise Server, and Ubuntu Linux up to version 15.10.
Can CVE-2014-8121 be exploited remotely?
Yes, CVE-2014-8121 can be exploited remotely by attackers performing a look-up on the affected database.
What is the impact of exploiting CVE-2014-8121?
Exploiting CVE-2014-8121 can cause a denial of service by triggering an infinite loop in the affected Name Service Switch.