CVE-2014-3917
kernel: DoS with syscall auditing
Severity Score
3.3
*CVSS v2
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
-
*SSVC
Descriptions
kernel/auditsc.c in the Linux kernel through 3.14.5, when CONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local users to obtain potentially sensitive single-bit values from kernel memory or cause a denial of service (OOPS) via a large value of a syscall number.
kernel/auditsc.c en el kernel de Linux hasta 3.14.5, cuando CONFIG_AUDITSYSCALL está habilitado con ciertas normas syscall, permite a usuarios locales obtener valores de un único bit potencialmente sensibles de la memoria del kernel o causar una denegación de servicio (OOPS) a través de un valor grande de un número syscall.
An out-of-bounds memory access flaw was found in the Linux kernel's system call auditing implementation. On a system with existing audit rules defined, a local, unprivileged user could use this flaw to leak kernel memory to user space or, potentially, crash the system.
*Credits:
N/A
CVSS Scores
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:-
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2014-05-29 CVE Reserved
- 2014-06-05 CVE Published
- 2023-03-08 EPSS Updated
- 2024-08-06 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-119: Improper Restriction of Operations within the Bounds of a Memory Buffer
- CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CAPEC
References (12)
| URL | Tag | Source |
|---|---|---|
| http://article.gmane.org/gmane.linux.kernel/1713179 | Mailing List | |
| http://secunia.com/advisories/59777 | Third Party Advisory | |
| http://secunia.com/advisories/60011 | Third Party Advisory | |
| http://secunia.com/advisories/60564 | Third Party Advisory | |
| http://www.openwall.com/lists/oss-security/2014/05/29/5 | Mailing List |
|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|---|---|
| http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html | 2021-07-15 | |
| http://rhn.redhat.com/errata/RHSA-2014-1143.html | 2021-07-15 | |
| http://rhn.redhat.com/errata/RHSA-2014-1281.html | 2021-07-15 | |
| http://www.ubuntu.com/usn/USN-2334-1 | 2021-07-15 | |
| http://www.ubuntu.com/usn/USN-2335-1 | 2021-07-15 | |
| https://bugzilla.redhat.com/show_bug.cgi?id=1102571 | 2014-09-22 | |
| https://access.redhat.com/security/cve/CVE-2014-3917 | 2014-09-22 |
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Suse Search vendor "Suse" | Linux Enterprise Desktop Search vendor "Suse" for product "Linux Enterprise Desktop" | 10.0 Search vendor "Suse" for product "Linux Enterprise Desktop" and version "10.0" | sp4, lts |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 5 Search vendor "Redhat" for product "Enterprise Linux" and version "5" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux" | 6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0" | - |
Affected
| ||||||
| Redhat Search vendor "Redhat" | Enterprise Mrg Search vendor "Redhat" for product "Enterprise Mrg" | 2.0 Search vendor "Redhat" for product "Enterprise Mrg" and version "2.0" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | <= 3.14.5 Search vendor "Linux" for product "Linux Kernel" and version " <= 3.14.5" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc1 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc2 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc3 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc4 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc5 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc6 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc7 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14" | rc8 |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14.1 Search vendor "Linux" for product "Linux Kernel" and version "3.14.1" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14.2 Search vendor "Linux" for product "Linux Kernel" and version "3.14.2" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14.3 Search vendor "Linux" for product "Linux Kernel" and version "3.14.3" | - |
Affected
| ||||||
| Linux Search vendor "Linux" | Linux Kernel Search vendor "Linux" for product "Linux Kernel" | 3.14.4 Search vendor "Linux" for product "Linux Kernel" and version "3.14.4" | - |
Affected
| ||||||