CVE-2014-8173: Null Pointer Dereference
A NULL pointer dereference flaw was found in the way Linux kernel's madvise MADVWILLNEED functionality handled page table locking. An unprivileged local user could use this flaw to crash the system.
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ee53664bda169f519ce3c6a22d378f0b946c8178
Other sources
The pmdnoneortranshugeorclearbad function in include/asm-generic/pgtable.h in the Linux kernel before 3.13 on NUMA systems does not properly determine whether a Page Middle Directory (PMD) entry is a transparent huge-table entry, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted MADVWILLNEED madvise system call that leverages the absence of a page-table lock.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8173?
CVE-2014-8173 is considered to have moderate severity due to its potential to allow an unprivileged user to crash the system.
How do I fix CVE-2014-8173?
To fix CVE-2014-8173, it is recommended to update the Linux kernel to a version where the vulnerability has been patched.
Which versions of the Linux kernel are affected by CVE-2014-8173?
CVE-2014-8173 affects Linux kernel versions from 3.9 to 3.10.76 and from 3.11 to 3.12.43, as well as 3.12.9 and below for NUMA systems.
What type of vulnerability is CVE-2014-8173?
CVE-2014-8173 is a NULL pointer dereference vulnerability associated with the madvise MADV_WILLNEED functionality in the Linux kernel.
Can CVE-2014-8173 be exploited remotely?
CVE-2014-8173 cannot be exploited remotely as it requires an unprivileged local user to access the affected functionality.