CVE-2014-3153 : The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Published 2014-06-07 14:55:27

Updated 2024-12-19 18:24:50

Source Chrome

View at NVD, CVE.org

Products affected by CVE-2014-3153

Redhat » Enterprise Linux Server Aus » Version: 6.2
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.13 and before (<) 3.14.6
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.5 and before (<) 3.10.42
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.3 and before (<) 3.4.92
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions before (<) 3.2.60
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.11 and before (<) 3.12.22
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Desktop » Version: 11 Update SP3
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Server » Version: 11
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise Server » Version: 11 Update SP3 For Vmware
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
Matching versions
Suse » Linux Enterprise Server » Version: 11 Update SP2 Ltss Edition
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
Matching versions
Suse » Linux Enterprise Server » Version: 11 Update SP3
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
Matching versions
Suse » Linux Enterprise Real Time Extension » Version: 11 Update SP3
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
Matching versions
Suse » Linux Enterprise High Availability Extension » Version: 11 Update SP3
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*
Matching versions
Oracle » Linux » Version: 5
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
Matching versions
Oracle » Linux » Version: 6
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Opensuse » Opensuse » Version: 11.4
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
Matching versions

CVE-2014-3153 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Linux Kernel Privilege Escalation Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2014-3153

Added on 2022-05-25 Action due date 2022-06-15

Exploit prediction scoring system (EPSS) score for CVE-2014-3153

EPSS FAQ

0.54%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 77 %

Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2014-3153

Android 'Towelroot' Futex Requeue Kernel Exploit

Disclosure Date: 2014-05-03

First seen: 2020-04-26

exploit/android/local/futex_requeue

This module exploits a bug in futex_requeue in the Linux kernel, using similar techniques employed by the towelroot exploit. Any Android device with a kernel built before June 2014 is likely to be vulnerable. Authors: - Pinkie Pie - geohot - timw

More information

CVSS scores for CVE-2014-3153

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.2	HIGH	AV:L/AC:L/Au:N/C:C/I:C/A:C	3.9	10.0	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
7.8	HIGH	CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST	2024-07-02
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2014-3153

https://github.com/elongl/CVE-2014-3153

GitHub - elongl/CVE-2014-3153: Exploiting CVE-2014-3153, AKA Towelroot.
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1103626

1103626 – (CVE-2014-3153) CVE-2014-3153 kernel: futex: pi futexes requeue issue
Issue Tracking;Third Party Advisory
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8

futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == u… · torvalds/linux@e9c243a · GitHub
Patch
http://www.debian.org/security/2014/dsa-2949

Debian -- Security Information -- DSA-2949-1 linux
Exploit

CVEs referencing this url
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270

kernel/git/torvalds/linux.git - Linux kernel source tree
Mailing List;Patch
http://secunia.com/advisories/59029

Sign in
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html

[security-announce] SUSE-SU-2014:1316-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e

kernel/git/torvalds/linux.git - Linux kernel source tree
Mailing List;Patch
http://openwall.com/lists/oss-security/2014/06/05/24

oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153)
Mailing List
http://secunia.com/advisories/59386

Sign in
Broken Link

CVEs referencing this url
http://secunia.com/advisories/59309

Sign in
Broken Link

CVEs referencing this url
http://secunia.com/advisories/58990

Sign in
Broken Link
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html

[security-announce] SUSE-SU-2014:0837-1: important: Security update for
Mailing List;Third Party Advisory
http://www.securitytracker.com/id/1030451

Linux Kernel PI Futex Requeuing Bug Lets Local Users Gain Elevated Privileges - SecurityTracker
Broken Link;Third Party Advisory;VDB Entry
http://openwall.com/lists/oss-security/2014/06/06/20

oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153)
Mailing List
http://secunia.com/advisories/59262

Sign in
Broken Link

CVEs referencing this url
http://rhn.redhat.com/errata/RHSA-2014-0800.html

RHSA-2014:0800 - Security Advisory - Red Hat Customer Portal
Third Party Advisory

CVEs referencing this url
http://www.exploit-db.com/exploits/35370

Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation - Linux local Exploit
Third Party Advisory;VDB Entry
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html

[security-announce] openSUSE-SU-2014:0878-1: important: kernel update fi
Mailing List;Third Party Advisory
http://secunia.com/advisories/59153

Sign in
Broken Link
https://www.openwall.com/lists/oss-security/2021/02/01/4

oss-security - Re: Linux Kernel: local priv escalation via futexes
Mailing List
http://www.ubuntu.com/usn/USN-2240-1

USN-2240-1: Linux kernel vulnerabilities | Ubuntu security notices
Third Party Advisory

CVEs referencing this url
http://www.openwall.com/lists/oss-security/2014/06/05/22

oss-security - Linux kernel futex local privilege escalation (CVE-2014-3153)
Mailing List
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html

[security-announce] SUSE-SU-2014:0796-1: important: Security update for
Mailing List;Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339

kernel/git/torvalds/linux.git - Linux kernel source tree
Mailing List;Patch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e9c243a5a6de0be8e584c604d353412584b592f8

kernel/git/torvalds/linux.git - Linux kernel source tree
Patch;Vendor Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8

Broken Link
http://linux.oracle.com/errata/ELSA-2014-3039.html

linux.oracle.com | ELSA-2014-3039
Third Party Advisory
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html

[security-announce] SUSE-SU-2014:1319-1: important: Security update for
Mailing List;Third Party Advisory

CVEs referencing this url
http://linux.oracle.com/errata/ELSA-2014-0771.html

linux.oracle.com | ELSA-2014-0771
Third Party Advisory

CVEs referencing this url
http://secunia.com/advisories/59599

Sign in
Broken Link

CVEs referencing this url
http://linux.oracle.com/errata/ELSA-2014-3037.html

linux.oracle.com | ELSA-2014-3037
Third Party Advisory
http://www.openwall.com/lists/oss-security/2021/02/01/4

oss-security - Re: Linux Kernel: local priv escalation via futexes
Mailing List

CVEs referencing this url
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html

[security-announce] SUSE-SU-2014:0775-1: critical: Security update for L
Mailing List;Third Party Advisory
http://www.ubuntu.com/usn/USN-2237-1

USN-2237-1: Linux kernel (Quantal HWE) vulnerability | Ubuntu security notices
Third Party Advisory
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html

Exploiting CVE-2014-3153 (Towelroot) | Elon Gliksberg
Exploit
http://secunia.com/advisories/59092

Sign in
Broken Link
http://linux.oracle.com/errata/ELSA-2014-3038.html

linux.oracle.com | ELSA-2014-3038
Third Party Advisory
http://www.securityfocus.com/bid/67906

Linux Kernel CVE-2014-3153 Local Privilege Escalation Vulnerability
Broken Link;Third Party Advisory;VDB Entry
http://secunia.com/advisories/58500

Sign in
Broken Link

Jump to