CVE-2014-9710: Race Condition
Last updated 24 July 2024
Other sources
Linux kernel built with the Btrfs Filesystem support(CONFIGBTRFSFS) is vulnerable to a race condition which leaves the extended attribute(xattr) empty for a short time window. This could be leveraged to bypass set ACLs and potentially escalate user privileges.
An unprivileged user could use this flaw to potentially escalate privileges on a system.
Upstream fix: ------------- -> https://git.kernel.org/linus/5f5bc6b1e2d5a6f827bc860ef2dc5b6f365d1339
— Red Hat
The Btrfs implementation in the Linux kernel before 3.19 does not ensure that the visible xattr state is consistent with a requested replacement, which allows local users to bypass intended ACL settings and gain privileges via standard filesystem operations (1) during an xattr-replacement time window, related to a race condition, or (2) after an xattr-replacement attempt that fails because the data does not fit.
— Launchpad
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
debian/linuxto a version that resolves this vulnerability.Fixed in 5.10.223-1Fixed in 5.10.234-1Fixed in 6.1.129-1Fixed in 6.1.135-1Fixed in 6.12.22-1Fixed in 6.12.25-1 - Upgrade
Upgrade
ubuntu/linuxto a version that resolves this vulnerability.Fixed in 3.13.0-57.95 - Upgrade
Upgrade
ubuntu/linux-lts-utopicto a version that resolves this vulnerability.Fixed in 3.16.0-38.52~14.04.1 - Upgrade
Upgrade
Linux kernelto a version that resolves this vulnerability.Fixed in 3.19
Event History
Frequently Asked Questions
What is the severity of CVE-2014-9710?
CVE-2014-9710 has a moderate severity level due to the potential for privilege escalation.
How do I fix CVE-2014-9710?
The recommended fix for CVE-2014-9710 is to upgrade to a patched version of the Linux kernel, specifically versions 5.10.223-1, 5.10.226-1, 6.1.123-1, 6.1.128-1, 6.12.12-1, or 6.12.13-1.
Which versions of the Linux kernel are affected by CVE-2014-9710?
CVE-2014-9710 affects Linux kernel versions prior to 3.10.83 and between 3.11 and 3.18.8.
What is the attack vector for CVE-2014-9710?
The attack vector for CVE-2014-9710 involves exploiting a race condition in the Btrfs filesystem that can lead to bypassing set ACLs.
Who is affected by CVE-2014-9710?
Users with Linux systems running the affected kernel versions utilizing the Btrfs filesystem are at risk of CVE-2014-9710.