Last updated 24 July 2024
Common Vulnerabilities and Exposures assigned an identifier CVE-2014-9090 to the following vulnerability:
Name: CVE-2014-9090 URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9090 Assigned: 20141126 Reference: http://www.openwall.com/lists/oss-security/2014/11/26/5 Reference: http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=6f442be2fb22be02cafa606f1769fa1e6f894441 Reference: https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
The dodoublefault function in arch/x86/kernel/traps.c in the Linux kernel through 3.17.4 does not properly handle faults associated with the Stack Segment (SS) segment register when espfix64 is involved, which allows local users to cause a denial of service (panic) via a modifyldt system call, as demonstrated by sigreturn32 in the linux-clock-tests test suite.
Last updated 24 July 2024
An SCTP server doing ASCONF will panic on malformed INIT ping-of-death in the form of:
------------ INIT[PARAM: SETPRIMARYIP] ------------>
A remote attacker could use this flaw to crash the system by sending a maliciously prepared SCTP packet in order to trigger a NULL pointer dereference on the server.
Upstream patch:
https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=e40607cbe270a9e8360907cb1e62ddf0736e4864
Acknowledgements:
This issue was discovered by Liu Wei of Red Hat.
It was found that Linux kernel's sctp stack is prone to remotely triggerable memory pressure issue caused by excessive queueing.
A remote attacker could use this flaw to cause denial-of-service conditions on the system.
Upstream commmit:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=26b87c7881006311828bb0ab271a551a62dcceb4
It was found that reporting emulation failures to user space could lead to either a local (CVE-2014-7842) or a L2->L1 (CVE-2010-5313) denial of service. In the case of a local denial of service, an attacker must have access to the MMIO area or be able to access an I/O port. Please note that on certain systems, HPET is mapped to userspace as part of vdso (vvar) and thus an unprivileged user may generate MMIO transactions (and enter the emulator) this way.
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
Buffer overflow in the nfs4getacluncached function in fs/nfs/nfs4proc.c in the Linux kernel before 3.7.2 allows local users to cause a denial of service (memory corruption and system crash) or possibly have unspecified other impact via a getxattr system call for the system.nfs4acl extended attribute of a pathname on an NFSv4 filesystem.
Buffer overflow in the exitcodeprocwrite function in arch/um/kernel/exitcode.c in the Linux kernel before 3.12 allows local users to cause a denial of service or possibly have unspecified other impact by leveraging root privileges for a write operation.
Last updated 24 July 2024
Buffer overflow in the ozcdevwrite function in drivers/staging/ozwpa ...
Last updated 24 July 2024
Last updated 24 July 2024
Last updated 24 July 2024
A flaw was found in the way ipcrcuputref() function handled reference counter decrementing. Without external synchronization reference counter might not be adjusted properly, as presented with the freeque() vs domsgsnd() race, leading to memory leaks.
An unprivileged local user could use this flaw to cause OOM conditions, potentially crashing the system.
References: https://wiki.openvz.org/Download/kernel/rhel6-testing/042stab084.3
Upstream patch: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=6062a8 (making the refcounter atomic hunks)
Acknowledgements:
Red Hat would like to thank Vladimir Davydov (Parallels) for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
drivers/hid/hid-sony.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIGHIDSONY is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
drivers/hid/hid-steelseries.c in the Human Interface Device (HID) subsystem in the Linux kernel through 3.11, when CONFIGHIDSTEELSERIES is enabled, allows physically proximate attackers to cause a denial of service (heap-based out-of-bounds write) via a crafted device.
Alan Chester reported an issue with IPv6 on SCTP that IPsec traffic is not being encrypted, whereas on IPv4 it is. Setting up an AH + ESP transport does not seem to have the desired effect:
SCTP + IPv4:
22:14:20.809645 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 116) 192.168.0.2 > 192.168.0.5: AH(spi=0x00000042,sumlen=16,seq=0x1): ESP(spi=0x00000044,seq=0x1), length 72 22:14:20.813270 IP (tos 0x2,ECT(0), ttl 64, id 0, offset 0, flags [DF], proto AH (51), length 340) 192.168.0.5 > 192.168.0.2: AH(spi=0x00000043,sumlen=16,seq=0x1):
SCTP + IPv6:
22:31:19.215029 IP6 (class 0x02, hlim 64, next-header SCTP (132) payload length: 364) fe80::222:15ff:fe87:7fc.3333 > fe80::92e6:baff:fe0d:5a54.36767: sctp 1) [INIT ACK] [init tag: 747759530] [rwnd: 62464] [OS: 10] [MIS: 10]
References: https://bugzilla.kernel.org/showbug.cgi?id=24412
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=95ee62083cb6453e056562d91f597552021e6ae7
A flaw was found in the way ansi cprng implementation in the Linux kernel processed non-block size aligned requests. If several small requests are made that are less than the instances block size, the remainder for loop code doesn't increment randdatavalid in the last iteration, meaning that the last bytes in the randdata buffer gets reused on the subsequent smaller-than-a-block request for random data.
Acknowledgements:
Red Hat would like to thank Stephan Mueller for reporting this issue.
A flaw was found in the way Linux kernel's device-mapper subsystem, under certain conditions, interpreted data written to snapshot block devices. Snapshots are constructed from a single "cow" (copy-on-write) device that contains a mixture of data and metadata, and the bug involves a user writing a data block that is later incorrectly interpreted as metadata controlling how blocks are mapped.
An attacker could construct a mapping to read data from disk blocks in 'free space' that is normally inaccessible.
Please note that apart from having security consequences (data leak), this bug is also a data corruptor.
Acknowledgements:
Red Hat would like to thank Fujitsu for reporting this issue.
Last updated 24 July 2024
Last updated 24 July 2024
A flaw was found in the way Linux kernel's SCTP network protocol implementation handled duplicate cookies. A transient empty association is created while processing the duplicate cookie chunk that userspace could query, potentially leading to NULL pointer dereference. A remote attacker able to initiate SCTP connection to the system could use this flaw to create transient conditions that could lead to remote system crash if remote system user is querying SCTP connection info at the time these conditions exist.
Upstream fix: http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f2815633504b442ca0b0605c16bf3d88a3a0fcea
Last updated 24 July 2024
Last updated 24 July 2024
Linux kernel built with an Ext4 file system is vulnerable to a system hang situation when [auto]mounting a non-journal filesystem with an orphan list to clear.
A user could use this flaw to stall the system resulting in DoS.
Upstream fix: ------------- -> https://git.kernel.org/linus/0e9a9a1ad619e7e987815d20262d36a2f95717ca