CVE-2014-9748: Race Condition
The uvrwlockt fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
libuvto a version that resolves this vulnerability.Fixed in 1.7.4
Event History
Parent advisories
This vulnerability appears in the following advisories.
Frequently Asked Questions
What is the severity of CVE-2014-9748?
The severity of CVE-2014-9748 is high with a severity value of 8.1.
How does CVE-2014-9748 impact Windows XP and Server 2003?
CVE-2014-9748 allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact on Windows XP and Server 2003.
What is the affected software for CVE-2014-9748?
The affected software for CVE-2014-9748 includes versions of Libuv before 1.7.4 and versions of Node.js between 0.10.0 and 0.10.46 or 0.12.0 and 0.12.15.
How can I fix CVE-2014-9748?
To fix CVE-2014-9748, update Libuv to version 1.7.4 or later, or upgrade Node.js to a version beyond the vulnerable ranges.
Where can I find more information about CVE-2014-9748?
You can find more information about CVE-2014-9748 on the following references: [GitHub Issue](https://github.com/libuv/libuv/issues/515), [GitHub Pull Request](https://github.com/libuv/libuv/pull/516), [Node.js Pull Request](https://github.com/nodejs/node/pull/2723).