Vulnerability Details : CVE-2014-6410
The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.
Vulnerability category: Denial of service
Threat overview for CVE-2014-6410
Top countries where our scanners detected CVE-2014-6410
Top open port discovered on systems with this issue
49152
IPs affected by CVE-2014-6410 16,326
Threat actors abusing to this issue?
Yes
Find out if you* are
affected by CVE-2014-6410!
*Directly or indirectly through your vendors, service providers and 3rd parties.
Powered by
attack surface intelligence
from SecurityScorecard.
Exploit prediction scoring system (EPSS) score for CVE-2014-6410
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 47 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2014-6410
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
4.7
|
MEDIUM | AV:L/AC:M/Au:N/C:N/I:N/A:C |
3.4
|
6.9
|
NIST |
CWE ids for CVE-2014-6410
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-6410
-
http://www.ubuntu.com/usn/USN-2376-1
USN-2376-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2014/09/15/9
oss-security - Re: CVE request for Linux kernel: udf: Avoid infinite loop when processing indirect ICBs
-
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
[security-announce] SUSE-SU-2014:1316-1: important: Security update for
-
http://marc.info/?l=bugtraq&m=142722544401658&w=2
'[security bulletin] HPSBGN03282 rev.1 - HP Business Service Manager Virtual Appliance, Multiple Vuln' - MARC
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=c03aa9f6e1f938618e6db2e23afef0574efeeb65
kernel/git/torvalds/linux.git - Linux kernel source treeExploit;Vendor Advisory
-
http://www.ubuntu.com/usn/USN-2374-1
USN-2374-1: Linux kernel vulnerabilities | Ubuntu security notices
-
https://bugzilla.redhat.com/show_bug.cgi?id=1141809
1141809 – (CVE-2014-6410) CVE-2014-6410 kernel: udf: Avoid infinite loop when processing indirect ICBs
-
http://www.ubuntu.com/usn/USN-2377-1
USN-2377-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2378-1
USN-2378-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
-
http://marc.info/?l=bugtraq&m=142722450701342&w=2
'[security bulletin] HPSBGN03285 rev.1 - HP Business Service Manager Virtual Appliance, Multiple Vul' - MARC
-
http://www.ubuntu.com/usn/USN-2375-1
USN-2375-1: Linux kernel (EC2) vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2014-1318.html
RHSA-2014:1318 - Security Advisory - Red Hat Customer Portal
-
http://www.securityfocus.com/bid/69799
Linux Kernel 'fs/udf/inode.c' Local Denial of Service Vulnerability
-
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
[security-announce] SUSE-SU-2014:1319-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2379-1
USN-2379-1: Linux kernel vulnerabilities | Ubuntu security notices
-
https://github.com/torvalds/linux/commit/c03aa9f6e1f938618e6db2e23afef0574efeeb65
udf: Avoid infinite loop when processing indirect ICBs · torvalds/linux@c03aa9f · GitHubExploit
Products affected by CVE-2014-6410
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.16.1:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.16.0:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:3.16.2:*:*:*:*:*:*:*