CVE-2014-9529: Race Condition
It was reported [1] that the Linux kernel suffered from a flaw when doing key garbage collection. The patch [1] describes the issue as:
""" When a key is being garbage collected, it's key->user would get put before the ->destroy() callback is called, where the key is removed from it's respective tracking structures.
This leaves a key hanging in a semi-invalid state which leaves a window open for a different task to try an access key->user. An example is findkeyringbyname() which would dereference key->user for a key that is in the process of being garbage collected (where key->user was freed but ->destroy() wasn't called yet - so it's still present in the linked list).
"""
An unprivileged local user could use this flaw to crash the system.
[1] http://marc.info/?l=linux-kernel&m=141986398232547&w=2
Other sources
Race condition in the keygcunusedkeys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.
— Launchpad
Affected Software
Remediation
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9529?
CVE-2014-9529 has a medium severity rating due to its potential impact on system integrity during key garbage collection.
How do I fix CVE-2014-9529?
To fix CVE-2014-9529, update to a patched version of the Linux kernel, specifically version 5.10.223-1 or later.
Which versions of the Linux kernel are affected by CVE-2014-9529?
CVE-2014-9529 affects Linux kernel versions up to 3.18.2, including various version ranges between 3.2.67 and 3.18.x.
Is CVE-2014-9529 specific to any Linux distributions?
Yes, CVE-2014-9529 impacts multiple distributions including Red Hat, Debian, and Ubuntu with specific version ranges.
What are the potential consequences of CVE-2014-9529 if left unpatched?
If CVE-2014-9529 is left unpatched, it may allow unauthorized access to sensitive information or system compromise during key management operations.