CVE-2014-8559

kernel: fs: deadlock due to incorrect usage of rename_lock

Severity Score

5.5

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

The d_walk function in fs/dcache.c in the Linux kernel through 3.17.2 does not properly maintain the semantics of rename_lock, which allows local users to cause a denial of service (deadlock and system hang) via a crafted application.

La función d_walk en fs/dcache.c en el kernel de Linux hasta 3.17.2 no mantiene debidamente la semántica de rename_lock, lo que permite a usuarios locales causar una denegación de servicio (bloqueo y cuelgue del sistema) a través de una aplicación manipulada.

A flaw was found in the way the Linux kernel's VFS subsystem handled file system locks. A local, unprivileged user could use this flaw to trigger a deadlock in the kernel, causing a denial of service on the system.

*Credits: N/A

CVSS Scores

Attack Vector

Local

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Attack Vector

Local

Attack Complexity

Low

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

Attack Vector

Local

Attack Complexity

High

Authentication

None

Confidentiality

None

Integrity

None

Availability

Complete

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2014-10-30 CVE Reserved
2014-11-10 CVE Published
2023-03-08 EPSS Updated
2024-08-06 CVE Updated
2024-08-06 First Exploit
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-400: Uncontrolled Resource Consumption

CAPEC

References (32)

URL	Tag	Source
http://secunia.com/advisories/62801	Broken Link
http://www.openwall.com/lists/oss-security/2014/10/30/7	Mailing List
http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html	Third Party Advisory
http://www.securityfocus.com/bid/70854	Third Party Advisory
http://www.securitytracker.com/id/1034051	Third Party Advisory
https://lkml.org/lkml/2014/10/26/101	Mailing List
https://lkml.org/lkml/2014/10/26/128	Mailing List
https://lkml.org/lkml/2014/10/26/129	Mailing List
https://support.f5.com/csp/article/K05211147	Third Party Advisory

URL	Date	SRC
http://www.debian.org/security/2015/dsa-3170	2024-08-06
https://lkml.org/lkml/2014/10/25/171	2024-08-06
https://lkml.org/lkml/2014/10/26/116	2024-08-06

URL	Date	SRC
https://bugzilla.redhat.com/show_bug.cgi?id=1159313	2015-11-03
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=946e51f2bf37f1656916eb75bd0742ba33983c28	2020-08-13
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=ca5358ef75fc69fee5322a38a340f5739d997c10	2020-08-13
https://lkml.org/lkml/2014/10/25/179	2020-08-13
https://lkml.org/lkml/2014/10/25/180	2020-08-13

URL	Date	SRC
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html	2020-08-13
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html	2020-08-13
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html	2020-08-13
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html	2020-08-13
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html	2020-08-13
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html	2020-08-13
http://rhn.redhat.com/errata/RHSA-2015-1976.html	2020-08-13
http://rhn.redhat.com/errata/RHSA-2015-1978.html	2020-08-13
http://www.ubuntu.com/usn/USN-2492-1	2020-08-13
http://www.ubuntu.com/usn/USN-2493-1	2020-08-13
http://www.ubuntu.com/usn/USN-2515-1	2020-08-13
http://www.ubuntu.com/usn/USN-2516-1	2020-08-13
http://www.ubuntu.com/usn/USN-2517-1	2020-08-13
http://www.ubuntu.com/usn/USN-2518-1	2020-08-13
https://access.redhat.com/security/cve/CVE-2014-8559	2015-11-03

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linux Search vendor "Linux"		Linux Kernel Search vendor "Linux" for product "Linux Kernel"				<= 3.17.2 Search vendor "Linux" for product "Linux Kernel" and version " <= 3.17.2"		-		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				12.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "12.04"		esm		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				14.04 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.04"		esm		Affected
Canonical Search vendor "Canonical"		Ubuntu Linux Search vendor "Canonical" for product "Ubuntu Linux"				14.10 Search vendor "Canonical" for product "Ubuntu Linux" and version "14.10"		-		Affected
Novell Search vendor "Novell"		Suse Linux Enterprise Desktop Search vendor "Novell" for product "Suse Linux Enterprise Desktop"				12.0 Search vendor "Novell" for product "Suse Linux Enterprise Desktop" and version "12.0"		-		Affected
Novell Search vendor "Novell"		Suse Linux Enterprise Server Search vendor "Novell" for product "Suse Linux Enterprise Server"				12.0 Search vendor "Novell" for product "Suse Linux Enterprise Server" and version "12.0"		-		Affected
Opensuse Search vendor "Opensuse"		Evergreen Search vendor "Opensuse" for product "Evergreen"				11.4 Search vendor "Opensuse" for product "Evergreen" and version "11.4"		-		Affected
Opensuse Search vendor "Opensuse"		Opensuse Search vendor "Opensuse" for product "Opensuse"				13.1 Search vendor "Opensuse" for product "Opensuse" and version "13.1"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Real Time Extension Search vendor "Suse" for product "Linux Enterprise Real Time Extension"				11 Search vendor "Suse" for product "Linux Enterprise Real Time Extension" and version "11"		sp3		Affected
Suse Search vendor "Suse"		Linux Enterprise Software Development Kit Search vendor "Suse" for product "Linux Enterprise Software Development Kit"				12 Search vendor "Suse" for product "Linux Enterprise Software Development Kit" and version "12"		-		Affected
Suse Search vendor "Suse"		Linux Enterprise Workstation Extension Search vendor "Suse" for product "Linux Enterprise Workstation Extension"				12 Search vendor "Suse" for product "Linux Enterprise Workstation Extension" and version "12"		-		Affected
Suse Search vendor "Suse"		Suse Linux Enterprise Server Search vendor "Suse" for product "Suse Linux Enterprise Server"				11 Search vendor "Suse" for product "Suse Linux Enterprise Server" and version "11"		sp2, ltss		Affected
Oracle Search vendor "Oracle"		Linux Search vendor "Oracle" for product "Linux"				7 Search vendor "Oracle" for product "Linux" and version "7"		-		Affected