CVE-2014-9420: Medium severity Google Android vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the iso9660 file system(CONFIGISO9660FS) support is vulnerable to an infinite recursion loop flaw, which could lead to a crash or render a system unresponsive/unusable after a while. The occurs while mounting an iso9660 image.
An unprivileged user/process could use this flaw to crash the system resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/f54e18f1b831c92f6512d2eedb224cd63d607d3d
— Red Hat
The rockcontinue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9420?
CVE-2014-9420 is considered a moderate severity vulnerability due to its potential to cause system crashes and unresponsiveness.
How do I fix CVE-2014-9420?
To fix CVE-2014-9420, update the Linux kernel to a version higher than 3.18.1 or apply relevant patches provided by your distribution.
Which systems are affected by CVE-2014-9420?
CVE-2014-9420 affects the Linux kernel up to version 3.18.1, as well as certain versions of Google Android that utilize this kernel.
What does CVE-2014-9420 exploit in the Linux kernel?
CVE-2014-9420 exploits an infinite recursion loop flaw in the iso9660 file system when attempting to mount an iso9660 image.
Can unprivileged users trigger CVE-2014-9420?
Yes, CVE-2014-9420 can be triggered by unprivileged users, leading to system crashes or unresponsiveness.