Information exposure in Linux kernel - CVE-2014-9900
Published: August 6, 2016 / Updated: November 28, 2016
Vulnerability identifier: #VU92798
CSH Severity: Low
CVSS v4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2014-9900
CWE-ID: CWE-200
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local non-authenticated attacker to gain access to sensitive information.
The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not initialize a certain data structure, which allows local users to obtain sensitive information via a crafted application, aka Android internal bug 28803952 and Qualcomm internal bug CR570754.
Affected software
Linux kernel
Ubuntu
linux (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
Ubuntu
linux (Ubuntu package)
linux-snapdragon (Ubuntu package)
linux-hwe (Ubuntu package)
How to mitigate CVE-2014-9900
Install update from vendor's repository.
linux (Ubuntu package) - addressed in versions 4.4.0-87.110, 4.8.0-59.64, 4.10.0-28.32
linux-snapdragon (Ubuntu package) - update to 4.4.0-1067.72
linux-hwe (Ubuntu package) - update to 4.10.0-28.32~16.04.2
linux-snapdragon (Ubuntu package) - update to 4.4.0-1067.72
linux-hwe (Ubuntu package) - update to 4.10.0-28.32~16.04.2