Permissions, Privileges, and Access Controls in Linux kernel and Google Android - CVE-2014-9322

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41004

Permissions, Privileges, and Access Controls in Linux kernel and Google Android - CVE-2014-9322

Published: December 17, 2014 / Updated: June 17, 2021


Vulnerability identifier: #VU41004
CSH Severity: High
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2014-9322
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vendor: Linux Foundation
Google
Affected software:
Linux kernel
Google Android

Detailed vulnerability description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.


How to mitigate CVE-2014-9322

Install update from vendor's website.

Sources