Buffer overflow in Linux kernel - CVE-2014-0069

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41986

Buffer overflow in Linux kernel - CVE-2014-0069

Published: February 28, 2014 / Updated: August 10, 2020


Vulnerability identifier: #VU41986
CSH Severity: Medium
CVSS v4: 7.5 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-0069
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.


Affected software

Linux kernel
Amazon Linux AMI
Ubuntu
linux (Ubuntu package)
linux-lts-quantal (Ubuntu package)
linux-lts-raring (Ubuntu package)
linux-lts-saucy (Ubuntu package)

How to mitigate CVE-2014-0069

Install update from vendor's website.

linux (Ubuntu package) - addressed in versions 3.2.0-63.95, 3.5.0-49.73, 3.11.0-20.34
linux-lts-quantal (Ubuntu package) - update to 3.5.0-49.73~precise1
linux-lts-raring (Ubuntu package) - update to 3.8.0-39.57~precise1
linux-lts-saucy (Ubuntu package) - update to 3.11.0-20.34~precise1

External References

Related Security Bulletins