CVE-2014-1453 : The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in

The NFS server (nfsserver) in FreeBSD 8.3 through 10.0 does not acquire locks in the proper order when converting a directory file handle to a vnode, which allows remote authenticated users to cause a denial of service (deadlock) via vectors involving a thread that uses the correct locking order.

Published 2014-04-16 18:37:13

Updated 2019-03-18 15:35:24

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2014-1453

Freebsd » Freebsd » Version: 9.0 Update Beta1
cpe:2.3:o:freebsd:freebsd:9.0:beta1:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.0 Update Beta2
cpe:2.3:o:freebsd:freebsd:9.0:beta2:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.0 Update Beta3
cpe:2.3:o:freebsd:freebsd:9.0:beta3:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 8.3
cpe:2.3:o:freebsd:freebsd:8.3:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 10.0
cpe:2.3:o:freebsd:freebsd:10.0:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.0
cpe:2.3:o:freebsd:freebsd:9.0:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.1
cpe:2.3:o:freebsd:freebsd:9.1:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.1 Update P4
cpe:2.3:o:freebsd:freebsd:9.1:p4:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.1 Update P5
cpe:2.3:o:freebsd:freebsd:9.1:p5:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.2 Update Prerelease
cpe:2.3:o:freebsd:freebsd:9.2:prerelease:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 8.4
cpe:2.3:o:freebsd:freebsd:8.4:*:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.2 Update RC2
cpe:2.3:o:freebsd:freebsd:9.2:rc2:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.2 Update RC1
cpe:2.3:o:freebsd:freebsd:9.2:rc1:*:*:*:*:*:*
Matching versions
Freebsd » Freebsd » Version: 9.2
cpe:2.3:o:freebsd:freebsd:9.2:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-1453

EPSS FAQ

0.55%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 75 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-1453

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
4.0	MEDIUM	AV:N/AC:L/Au:S/C:N/I:N/A:P	8.0	2.9	NIST
Access Vector: Network Access Complexity: Low Authentication: Single Confidentiality Impact: None Integrity Impact: None Availability Impact: Partial

CWE ids for CVE-2014-1453

CWE-399

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-1453

http://www.securityfocus.com/bid/66726

FreeBSD CVE-2014-1453 Remote Denial of Service Vulnerability
http://www.debian.org/security/2014/dsa-2952

Debian -- Security Information -- DSA-2952-1 kfreebsd-9

CVEs referencing this url
http://www.securitytracker.com/id/1030041

FreeBSD NFS Server Deadlock Bug Lets Remote Authenticated Users Deny Service - SecurityTracker
http://www.freebsd.org/security/advisories/FreeBSD-SA-14:05.nfsserver.asc

Vendor Advisory

Jump to

Vulnerability Details : CVE-2014-1453

Products affected by CVE-2014-1453

Exploit prediction scoring system (EPSS) score for CVE-2014-1453

CVSS scores for CVE-2014-1453

CWE ids for CVE-2014-1453

References for CVE-2014-1453