CVE-2014-3940

Kernel: missing check during hugepage migration

Severity Score

4.0

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The Linux kernel through 3.14.5 does not properly consider the presence of hugetlb entries, which allows local users to cause a denial of service (memory corruption or system crash) by accessing certain memory locations, as demonstrated by triggering a race condition via numa_maps read operations during hugepage migration, related to fs/proc/task_mmu.c and mm/mempolicy.c.

El kernel de Linux hasta 3.14.5 no considera debidamente la presencia de entradas hugetlb, lo que permite a usuarios locales causar una denegación de servicio (corrupción de memoria o caída de sistema) mediante el acceso a ciertas localizaciones de memoria, tal y como fue demostrado mediante el aprovechamiento de una condición de carrera a través de operaciones de lectura numa_maps durante la migración a hugepage, relacionado con fs/proc/task_mmu.c y mm/mempolicy.c.

A flaw was found in the way Linux kernel's Transparent Huge Pages (THP) implementation handled non-huge page migration. A local, unprivileged user could use this flaw to crash the kernel by migrating transparent hugepages.

*Credits: N/A

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

Partial

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-06-02 CVE Reserved
2014-06-05 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
---------- Exploited in Wild
---------- KEV Due Date
---------- First Exploit

CWE

CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

CAPEC

References (10)

URL	Tag	Source
http://secunia.com/advisories/59011	Third Party Advisory
http://secunia.com/advisories/61310	Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/06/02/5	Mailing List
http://www.securityfocus.com/bid/67786	Vdb Entry
https://lkml.org/lkml/2014/3/18/784	Mailing List
https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15685.html	X_refsource_confirm

URL	Date	SRC

URL	Date	SRC

URL	Date	SRC
http://rhn.redhat.com/errata/RHSA-2015-0290.html	2021-07-15
http://rhn.redhat.com/errata/RHSA-2015-1272.html	2021-07-15
https://bugzilla.redhat.com/show_bug.cgi?id=1104097	2015-07-20
https://access.redhat.com/security/cve/CVE-2014-3940	2015-07-20

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Redhat Search vendor "Redhat"		Enterprise Linux Search vendor "Redhat" for product "Enterprise Linux"				6.0 Search vendor "Redhat" for product "Enterprise Linux" and version "6.0"		-		Affected
Redhat Search vendor "Redhat"		Enterprise Mrg Search vendor "Redhat" for product "Enterprise Mrg"				2.0 Search vendor "Redhat" for product "Enterprise Mrg" and version "2.0"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				<= 3.14.5 Search vendor "Linux" for product "Linux Kernel" and version " <= 3.14.5"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc1		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc2		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc3		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc4		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc5		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc6		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc7		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14 Search vendor "Linux" for product "Linux Kernel" and version "3.14"		rc8		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14.1 Search vendor "Linux" for product "Linux Kernel" and version "3.14.1"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14.2 Search vendor "Linux" for product "Linux Kernel" and version "3.14.2"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14.3 Search vendor "Linux" for product "Linux Kernel" and version "3.14.3"		-		Affected
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				3.14.4 Search vendor "Linux" for product "Linux Kernel" and version "3.14.4"		-		Affected