CVE-2014-9940: Use After Free

Published May 1, 2017

Updated

Last updated 24 July 2024

Other sources

The regulatorenagpiofree function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.

— Launchpad

Affected Software

14 affected componentsFixes available

Linux Linux kernel>3.10<3.16.45

Linux Linux kernel>=3.17<3.18.52

Linux Linux kernel=3.10

Linux Linux kernel=3.10-rc1

Linux Linux kernel=3.10-rc2

Linux Linux kernel=3.10-rc3

Linux Linux kernel=3.10-rc4

Linux Linux kernel=3.10-rc5

Linux Linux kernel=3.10-rc6

Linux Linux kernel=3.10-rc7

Google Android<=7.1.1

Linux Linux kernel>3.16.45

Google Android

debian/linux

6.1.176-16.1.190-16.12.107-16.12.113-17.2.12-1

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade debian/linux to a version that resolves this vulnerability.
Fixed in 6.1.176-1Fixed in 6.1.190-1Fixed in 6.12.107-1Fixed in 6.12.113-1Fixed in 7.2.12-1
Upgrade
Upgrade Linux kernel to a version that resolves this vulnerability.
Fixed in 3.19

Event History

May 1, 2017

CVE Published

via Android·12:00 AM

Data Sourced

via Android·12:00 AM

SeverityAffected Software

May 2, 2017

CVE Published

via MITRE·09:00 PM

Data Sourced

via MITRE·09:00 PM

Description

Parent advisories

This vulnerability appears in the following advisories.

DSA-3945

Frequently Asked Questions

What is CVE-2014-9940?

CVE-2014-9940 is a vulnerability in the Linux kernel that allows local users to gain privileges or cause a denial of service through a use-after-free issue in the regulator_ena_gpio_free function.

How severe is CVE-2014-9940?

CVE-2014-9940 has a severity rating of 7 (high).

Which software versions are affected by CVE-2014-9940?

Ubuntu Linux versions 3.13.0-123.172 and Linux kernel versions up to 3.19 are affected by CVE-2014-9940.

How can I fix CVE-2014-9940?

To fix CVE-2014-9940, you should update your Linux kernel to version 3.19 or higher.

Where can I find more information about CVE-2014-9940?

You can find more information about CVE-2014-9940 on the following references: [http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=60a2362f769cf549dc466134efe71c8bf9fbaaba](http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=60a2362f769cf549dc466134efe71c8bf9fbaaba), [https://github.com/torvalds/linux/commit/60a2362f769cf549dc466134efe71c8bf9fbaaba](https://github.com/torvalds/linux/commit/60a2362f769cf549dc466134efe71c8bf9fbaaba), [https://source.android.com/security/bulletin/2017-05-01](https://source.android.com/security/bulletin/2017-05-01)