CVE-2014-4699 : The Linux kernel before 3.15.4 on Intel processors does not properly restrict us

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

Published 2014-07-09 11:07:03

Updated 2024-02-16 20:27:26

Source MITRE

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2014-4699

Debian » Debian Linux » Version: 7.0
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 2.6.17 and before (<) 3.2.61
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.11 and before (<) 3.12.25
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.5 and before (<) 3.10.47
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.15 and before (<) 3.15.4
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.13 and before (<) 3.14.11
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Linux » Linux Kernel
Versions from including (>=) 3.3 and before (<) 3.4.97
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 14.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 10.04
cpe:2.3:o:canonical:ubuntu_linux:10.04:*:*:*:-:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 12.04 ESM Edition
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:esm:*:*:*
Matching versions
Canonical » Ubuntu Linux » Version: 13.10
cpe:2.3:o:canonical:ubuntu_linux:13.10:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2014-4699

EPSS FAQ

1.52%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 79 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2014-4699

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.9	MEDIUM	AV:L/AC:M/Au:N/C:C/I:C/A:C	3.4	10.0	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete

CWE ids for CVE-2014-4699

CWE-362 Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

The product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2014-4699

http://www.osvdb.org/108754

404 Not Found
Broken Link
http://www.openwall.com/lists/oss-security/2014/07/04/4

oss-security - CVE-2014-4699: Linux ptrace bug
Mailing List;Third Party Advisory
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47

Release Notes;Vendor Advisory
http://secunia.com/advisories/60393

Sign in
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2271-1

USN-2271-1: Linux kernel (Saucy HWE) vulnerability | Ubuntu security notices
Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1115927

1115927 – (CVE-2014-4699) CVE-2014-4699 kernel: x86_64: ptrace: sysret to non-canonical address
Issue Tracking;Patch;Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a

Broken Link;Third Party Advisory
http://secunia.com/advisories/59654

Sign in
Third Party Advisory
https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a

ptrace,x86: force IRET path after a ptrace_stop() · torvalds/linux@b9cd18d · GitHub
Patch;Third Party Advisory
http://www.ubuntu.com/usn/USN-2268-1

USN-2268-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.4

Release Notes;Vendor Advisory
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.97

Release Notes;Vendor Advisory
http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html

Linux Kernel ptrace/sysret Local Privilege Escalation ≈ Packet Storm
Exploit;Third Party Advisory;VDB Entry
http://openwall.com/lists/oss-security/2014/07/05/4

oss-security - Re: CVE-2014-4699: Linux ptrace bug
Mailing List;Third Party Advisory
https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11

Release Notes;Vendor Advisory
http://www.ubuntu.com/usn/USN-2273-1

USN-2273-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://openwall.com/lists/oss-security/2014/07/08/5

oss-security - Re: CVE-2014-4699: Linux ptrace bug
Mailing List;Third Party Advisory
http://www.ubuntu.com/usn/USN-2266-1

USN-2266-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://www.exploit-db.com/exploits/34134

Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - 'ptrace/sysret' Local Privilege Escalation - Linux_x86-64 local Exploit
Exploit;Third Party Advisory;VDB Entry
http://secunia.com/advisories/59633

Sign in
Third Party Advisory
http://www.ubuntu.com/usn/USN-2267-1

USN-2267-1: Linux kernel (EC2) vulnerability | Ubuntu security notices
Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-0924.html

linux.oracle.com | ELSA-2014-0924
Third Party Advisory

CVEs referencing this url
http://secunia.com/advisories/60220

Sign in
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2270-1

USN-2270-1: Linux kernel (Raring HWE) vulnerability | Ubuntu security notices
Third Party Advisory
http://www.ubuntu.com/usn/USN-2272-1

USN-2272-1: Linux kernel (Trusty HWE) vulnerability | Ubuntu security notices
Third Party Advisory
http://www.debian.org/security/2014/dsa-2972

Debian -- Security Information -- DSA-2972-1 linux
Third Party Advisory
http://secunia.com/advisories/60380

Sign in
Third Party Advisory

CVEs referencing this url
http://linux.oracle.com/errata/ELSA-2014-3048.html

linux.oracle.com | ELSA-2014-3048
Third Party Advisory

CVEs referencing this url
http://www.ubuntu.com/usn/USN-2274-1

USN-2274-1: Linux kernel vulnerability | Ubuntu security notices
Third Party Advisory
http://openwall.com/lists/oss-security/2014/07/08/16

oss-security - Re: CVE-2014-4699: Linux ptrace bug
Mailing List;Third Party Advisory
http://secunia.com/advisories/59639

Sign in
Third Party Advisory
http://www.ubuntu.com/usn/USN-2269-1

USN-2269-1: Linux kernel (Quantal HWE) vulnerability | Ubuntu security notices
Third Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3047.html

linux.oracle.com | ELSA-2014-3047
Third Party Advisory

CVEs referencing this url
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a

kernel/git/torvalds/linux.git - Linux kernel source tree
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2014-4699

Products affected by CVE-2014-4699

Exploit prediction scoring system (EPSS) score for CVE-2014-4699

CVSS scores for CVE-2014-4699

CWE ids for CVE-2014-4699

References for CVE-2014-4699