CVE-2014-9090: Medium severity Linux Linux kernel vulnerability
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-9090 to the following vulnerability:
Name: CVE-2014-9090 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090 Assigned: 20141126 Reference: http://www.openwall.com/lists/oss-security/2014/11/26/5 Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441 Reference: https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
The dodoublefault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register when espfix64 is involved, which allows local users to cause a denial of service (panic) via a modifyldt system call, as demonstrated by sigreturn32 in the linux-clock-tests test suite.
Other sources
The dodoublefault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to cause a denial of service (panic) via a modifyldt system call, as demonstrated by sigreturn32 in the linux-clock-tests test suite.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.25-1Fixed in 6.12.27-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-43.72 - Upgrade
Upgrade
ubuntu/linux-lts-utopicto a version that resolves this vulnerability.Fixed in 3.16.0-28.37~14.04.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Patch 6f442be2fb22be02cafa606f1769fa1e6f894441
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9090?
CVE-2014-9090 has been assigned a score of moderate severity.
How do I fix CVE-2014-9090?
To resolve CVE-2014-9090, update the Linux kernel to versions that are patched against this vulnerability.
What versions of the Linux kernel are affected by CVE-2014-9090?
CVE-2014-9090 affects Linux kernel versions up to 3.17.3 and specific release candidates from 3.0 to 3.17.
Is CVE-2014-9090 exploitable remotely?
CVE-2014-9090 can be exploited locally, making it a potential threat if an attacker gains access to the system.
What are the consequences of CVE-2014-9090 being exploited?
Exploitation of CVE-2014-9090 could lead to privilege escalation, allowing attackers to gain higher access rights to the system.