Vulnerability CVE-2014-1738
Published: 2014-05-11   Modified: 2014-05-12

Description:
The raw_cmd_copyout function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly restrict access to certain pointers during processing of an FDRAWCMD ioctl call, which allows local users to obtain sensitive information from kernel heap memory by leveraging write access to a /dev/fd device.

See advisories in our WLB2 database:
Topic
Author
Date
High
Linux Kernel 3.14.3 /dev/fd gain privileges
Matthew Daley
12.05.2014

Type:

CWE-264

 (Permissions, Privileges, and Access Controls)

CVSS2 => (AV:L/AC:L/Au:N/C:C/I:N/A:N)

CVSS Base Score
Impact Subscore
Exploitability Subscore
4.9/10
6.9/10
3.9/10
Exploit range
Attack complexity
Authentication
Local
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Complete
None
None
Affected software
Linux -> Linux kernel 

 References:
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2145e15e0557a01b9195d1c7199a1b92cb9be81f
http://linux.oracle.com/errata/ELSA-2014-0771.html
http://linux.oracle.com/errata/ELSA-2014-3043.html
http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html
http://rhn.redhat.com/errata/RHSA-2014-0800.html
http://rhn.redhat.com/errata/RHSA-2014-0801.html
http://www.debian.org/security/2014/dsa-2926
http://www.debian.org/security/2014/dsa-2928
http://www.openwall.com/lists/oss-security/2014/05/09/2
http://www.securityfocus.com/bid/67302
http://www.securitytracker.com/id/1030474
https://bugzilla.redhat.com/show_bug.cgi?id=1094299
https://github.com/torvalds/linux/commit/2145e15e0557a01b9195d1c7199a1b92cb9be81f
Copyright 2024, cxsecurity.com

 

Back to Top