CVE-2014-9322: High severity linux kernel vulnerability
arch/x86/kernel/entry64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
Other sources
It was found that because paranoid entry does not contain the swapgs fixup for badiret (unlike error entry), under certain conditions (#SS on iret) it can happen that badiret is reached with usergs instead of kernelgs that it is expecting.
A local unprivileged user can use this flaw to increase their privileges on the system.
Upstream fix: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441
Acknowledgements:
Red Hat would like to thank Andy Lutomirski for reporting this issue.
— Red Hat
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9322?
The severity of CVE-2014-9322 is classified as high due to its potential to allow local users to gain elevated privileges.
How do I fix CVE-2014-9322?
To fix CVE-2014-9322, upgrade to a Linux kernel version that is 3.17.5 or newer or ensure you are on a fixed version like 5.10.223-1 or 6.1.123-1.
What systems are affected by CVE-2014-9322?
CVE-2014-9322 affects various Linux kernel versions prior to 3.17.5, including those on operating systems like Debian, Ubuntu, and SUSE.
Can CVE-2014-9322 be exploited remotely?
CVE-2014-9322 cannot be exploited remotely as it requires local user access to the system.
What is the impact of CVE-2014-9322?
The impact of CVE-2014-9322 allows a local user to gain unauthorized privileges, potentially compromising system security.