CVE-2014-8181: Medium severity red hat enterprise linux vulnerability
In sgio, blkrqmapuser{,iov} may allocate a set of bounce buffer pages to do the bio, if it finds the user buffer cannot be directly mapped. But the allocated pages are not cleared.
If the bounce buffer is also not written to by device, garbage data is left, and copied back to user in blkrqunmapuser.
The allocated pages should be cleared. This also eliminates the risk of leaking sensitive information to userspace, which may have a security impact.
This flaw is specific to RHEL-7 and does not affect the current upstream kernel.
Other sources
The kernel in Red Hat Enterprise Linux 7 and MRG-2 does not clear garbage data for SGIO buffer, which may leaking sensitive information to userspace.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2014-8181?
The severity of CVE-2014-8181 is categorized as high due to the potential exposure of sensitive data.
How do I fix CVE-2014-8181?
To fix CVE-2014-8181, apply the latest security patches provided by your operating system vendor.
Which systems are affected by CVE-2014-8181?
CVE-2014-8181 affects Red Hat Enterprise Linux 7.0 and Red Hat Enterprise MRG 2.0.
What type of data is at risk with CVE-2014-8181?
CVE-2014-8181 risks exposing uninitialized memory contents that may contain sensitive or confidential information.
Is there a workaround for CVE-2014-8181 if I cannot apply a patch yet?
There are no known workarounds for CVE-2014-8181; applying the patch is the recommended mitigation.