CVE-2014-9585: Low severity Linux Linux kernel vulnerability
Last updated 24 July 2024
Other sources
Linux kernel built with the Virtual Dynamic Shared Object(vDSO) support is vulnerable to an information leakage flaw. It occurs due to less than perfect address randomisation, which leads to leakage of vDSO library base address.
An unprivileged user could use this flaw to leak kernel memory addresses.
Upstream fix: ------------- -> https://git.kernel.org/linus/394f56fe480140877304d342dec46d50dc823d46
Reference: ---------- -> http://seclists.org/oss-sec/2015/q1/103 -> https://bugzilla.kernel.org/showbug.cgi?id=89591 -> http://marc.info/?l=linux-kernel&m=141909723019695&w=2
The vdsoaddr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.
— Launchpad
Affected Software
Remediation
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9585?
CVE-2014-9585 is classified as an information leakage flaw with medium severity.
How do I fix CVE-2014-9585?
To fix CVE-2014-9585, it is recommended to upgrade to a patched version of the Linux kernel such as 5.10.223-1, 6.1.119-1, or later.
Which systems are affected by CVE-2014-9585?
CVE-2014-9585 affects various Linux kernel versions including 3.18.2 and below, along with several Red Hat Enterprise Linux distributions.
Can an unprivileged user exploit CVE-2014-9585?
Yes, an unprivileged user could exploit CVE-2014-9585 to gain access to information that should be protected.
What type of vulnerability is CVE-2014-9585?
CVE-2014-9585 is an information leakage vulnerability caused by insufficient address randomization.