CVE-2014-3153

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2014-3153
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

7.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

7.2 /10

CVSS v2.0 : HIGH

V2 Legend

Vector : AV:L/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 3.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References
Link Resource
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8 Broken Link
http://linux.oracle.com/errata/ELSA-2014-0771.html Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3037.html Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3038.html Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3039.html Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html Mailing List Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html Mailing List Third Party Advisory
http://openwall.com/lists/oss-security/2014/06/05/24 Mailing List
http://openwall.com/lists/oss-security/2014/06/06/20 Mailing List
http://rhn.redhat.com/errata/RHSA-2014-0800.html Third Party Advisory
http://secunia.com/advisories/58500 Broken Link
http://secunia.com/advisories/58990 Broken Link
http://secunia.com/advisories/59029 Broken Link
http://secunia.com/advisories/59092 Broken Link
http://secunia.com/advisories/59153 Broken Link
http://secunia.com/advisories/59262 Broken Link
http://secunia.com/advisories/59309 Broken Link
http://secunia.com/advisories/59386 Broken Link
http://secunia.com/advisories/59599 Broken Link
http://www.debian.org/security/2014/dsa-2949 Exploit
http://www.exploit-db.com/exploits/35370 Third Party Advisory VDB Entry
http://www.openwall.com/lists/oss-security/2014/06/05/22 Mailing List
http://www.openwall.com/lists/oss-security/2021/02/01/4 Mailing List
http://www.securityfocus.com/bid/67906 Broken Link Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1030451 Broken Link Third Party Advisory VDB Entry
http://www.ubuntu.com/usn/USN-2237-1 Third Party Advisory
http://www.ubuntu.com/usn/USN-2240-1 Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1103626 Issue Tracking Third Party Advisory
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html Exploit
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e Mailing List Patch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 Mailing List Patch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 Mailing List Patch
https://github.com/elongl/CVE-2014-3153 Third Party Advisory
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8 Patch
https://www.openwall.com/lists/oss-security/2021/02/01/4 Mailing List
Configurations

Configuration 1 (hide)

OR cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Configuration 2 (hide)

cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*

Configuration 3 (hide)

OR cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*

Configuration 4 (hide)

OR cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*

Configuration 5 (hide)

OR cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
History

02 Jul 2024, 12:17

Type Values Removed Values Added
References () http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8 - () http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8 - Broken Link
References () http://linux.oracle.com/errata/ELSA-2014-0771.html - () http://linux.oracle.com/errata/ELSA-2014-0771.html - Third Party Advisory
References () http://linux.oracle.com/errata/ELSA-2014-3037.html - () http://linux.oracle.com/errata/ELSA-2014-3037.html - Third Party Advisory
References () http://linux.oracle.com/errata/ELSA-2014-3038.html - () http://linux.oracle.com/errata/ELSA-2014-3038.html - Third Party Advisory
References () http://linux.oracle.com/errata/ELSA-2014-3039.html - () http://linux.oracle.com/errata/ELSA-2014-3039.html - Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html - () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html - () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html - () http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html - () http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - () http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html - Mailing List, Third Party Advisory
References () http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - () http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html - Mailing List, Third Party Advisory
References () http://openwall.com/lists/oss-security/2014/06/05/24 - () http://openwall.com/lists/oss-security/2014/06/05/24 - Mailing List
References () http://openwall.com/lists/oss-security/2014/06/06/20 - () http://openwall.com/lists/oss-security/2014/06/06/20 - Mailing List
References () http://rhn.redhat.com/errata/RHSA-2014-0800.html - () http://rhn.redhat.com/errata/RHSA-2014-0800.html - Third Party Advisory
References () http://secunia.com/advisories/58500 - () http://secunia.com/advisories/58500 - Broken Link
References () http://secunia.com/advisories/58990 - () http://secunia.com/advisories/58990 - Broken Link
References () http://secunia.com/advisories/59029 - () http://secunia.com/advisories/59029 - Broken Link
References () http://secunia.com/advisories/59092 - () http://secunia.com/advisories/59092 - Broken Link
References () http://secunia.com/advisories/59153 - () http://secunia.com/advisories/59153 - Broken Link
References () http://secunia.com/advisories/59262 - () http://secunia.com/advisories/59262 - Broken Link
References () http://secunia.com/advisories/59309 - () http://secunia.com/advisories/59309 - Broken Link
References () http://secunia.com/advisories/59386 - () http://secunia.com/advisories/59386 - Broken Link
References () http://secunia.com/advisories/59599 - () http://secunia.com/advisories/59599 - Broken Link
References () http://www.debian.org/security/2014/dsa-2949 - () http://www.debian.org/security/2014/dsa-2949 - Exploit
References () http://www.exploit-db.com/exploits/35370 - () http://www.exploit-db.com/exploits/35370 - Third Party Advisory, VDB Entry
References () http://www.openwall.com/lists/oss-security/2014/06/05/22 - () http://www.openwall.com/lists/oss-security/2014/06/05/22 - Mailing List
References () http://www.openwall.com/lists/oss-security/2021/02/01/4 - () http://www.openwall.com/lists/oss-security/2021/02/01/4 - Mailing List
References () http://www.securityfocus.com/bid/67906 - () http://www.securityfocus.com/bid/67906 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.securitytracker.com/id/1030451 - () http://www.securitytracker.com/id/1030451 - Broken Link, Third Party Advisory, VDB Entry
References () http://www.ubuntu.com/usn/USN-2237-1 - () http://www.ubuntu.com/usn/USN-2237-1 - Third Party Advisory
References () http://www.ubuntu.com/usn/USN-2240-1 - () http://www.ubuntu.com/usn/USN-2240-1 - Third Party Advisory
References () https://bugzilla.redhat.com/show_bug.cgi?id=1103626 - () https://bugzilla.redhat.com/show_bug.cgi?id=1103626 - Issue Tracking, Third Party Advisory
References () https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html - () https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html - Exploit
References () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e - () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e - Mailing List, Patch
References () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 - () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 - Mailing List, Patch
References () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 - () https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 - Mailing List, Patch
References () https://github.com/elongl/CVE-2014-3153 - () https://github.com/elongl/CVE-2014-3153 - Third Party Advisory
References () https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8 - () https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8 - Patch
References () https://www.openwall.com/lists/oss-security/2021/02/01/4 - () https://www.openwall.com/lists/oss-security/2021/02/01/4 - Mailing List
CWE CWE-269 NVD-CWE-noinfo
First Time Oracle linux
Oracle
Canonical ubuntu Linux
Canonical
CVSS v2 : 7.2
v3 : unknown 		v2 : 7.2
v3 : 7.8
CPE cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Information

Published : 2014-06-07 14:55

Updated : 2024-07-02 12:17

NVD link : CVE-2014-3153

Mitre link : CVE-2014-3153

CVE.ORG link : CVE-2014-3153

JSON object : View

Products Affected

suse

  • linux_enterprise_real_time_extension
  • linux_enterprise_high_availability_extension
  • linux_enterprise_server
  • linux_enterprise_desktop

opensuse

  • opensuse

canonical

  • ubuntu_linux

redhat

  • enterprise_linux_server_aus

oracle

  • linux

linux

  • linux_kernel
CWE
NVD-CWE-noinfo