Buffer overflow in Linux kernel - CVE-2014-1690
Published: February 28, 2014 / Updated: August 10, 2020
Vulnerability identifier: #VU41988
CSH Severity: Low
CVSS v4: 6.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-1690
CWE-ID: CWE-119
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote non-authenticated attacker to gain access to sensitive information.
The help function in net/netfilter/nf_nat_irc.c in the Linux kernel before 3.12.8 allows remote attackers to obtain sensitive information from kernel memory by establishing an IRC DCC session in which incorrect packet data is transmitted during use of the NAT mangle feature.
Affected software
Linux kernel
Ubuntu
linux-lts-raring (Ubuntu package)
linux (Ubuntu package)
linux-lts-saucy (Ubuntu package)
Ubuntu
linux-lts-raring (Ubuntu package)
linux (Ubuntu package)
linux-lts-saucy (Ubuntu package)
How to mitigate CVE-2014-1690
Install update from vendor's website.
linux-lts-raring (Ubuntu package) - update to 3.8.0-38.56~precise1
linux (Ubuntu package) - update to 3.11.0-18.32
linux-lts-saucy (Ubuntu package) - update to 3.11.0-18.32~precise1
linux (Ubuntu package) - update to 3.11.0-18.32
linux-lts-saucy (Ubuntu package) - update to 3.11.0-18.32~precise1
External References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2690d97ade05c5325cbf7c72b94b90d265659886
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.8
- http://www.openwall.com/lists/oss-security/2014/01/28/3
- http://www.ubuntu.com/usn/USN-2137-1
- http://www.ubuntu.com/usn/USN-2140-1
- http://www.ubuntu.com/usn/USN-2158-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1058748
- https://github.com/torvalds/linux/commit/2690d97ade05c5325cbf7c72b94b90d265659886