Vulnerability Details : CVE-2014-9420
The rock_continue function in fs/isofs/rock.c in the Linux kernel through 3.18.1 does not restrict the number of Rock Ridge continuation entries, which allows local users to cause a denial of service (infinite loop, and system crash or hang) via a crafted iso9660 image.
Vulnerability category: Denial of service
Products affected by CVE-2014-9420
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2014-9420
0.04%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 8 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2014-9420
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
4.9
|
MEDIUM | AV:L/AC:L/Au:N/C:N/I:N/A:C |
3.9
|
6.9
|
NIST |
CWE ids for CVE-2014-9420
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-9420
-
http://rhn.redhat.com/errata/RHSA-2015-1137.html
RHSA-2015:1137 - Security Advisory - Red Hat Customer Portal
-
https://source.android.com/security/bulletin/2017-01-01.html
Android Security Bulletin—January 2017 | Android Open Source Project
-
http://www.ubuntu.com/usn/USN-2518-1
USN-2518-1: Linux kernel vulnerabilities | Ubuntu security notices
-
https://github.com/torvalds/linux/commit/f54e18f1b831c92f6512d2eedb224cd63d607d3d
isofs: Fix infinite looping over CE entries · torvalds/linux@f54e18f · GitHub
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
[security-announce] SUSE-SU-2015:0652-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2490-1
USN-2490-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2515-1
USN-2515-1: Linux kernel (Trusty HWE) vulnerabilities | Ubuntu security notices
-
http://rhn.redhat.com/errata/RHSA-2015-1081.html
RHSA-2015:1081 - Security Advisory - Red Hat Customer Portal
-
http://rhn.redhat.com/errata/RHSA-2015-1138.html
RHSA-2015:1138 - Security Advisory - Red Hat Customer Portal
-
http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html
[security-announce] SUSE-SU-2015:0178-1: important: Security update for
-
https://bugzilla.redhat.com/show_bug.cgi?id=1175235
1175235 – (CVE-2014-9420) CVE-2014-9420 Kernel: fs: isofs: infinite loop in CE record entriesVendor Advisory
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f54e18f1b831c92f6512d2eedb224cd63d607d3d
-
http://www.ubuntu.com/usn/USN-2491-1
USN-2491-1: Linux kernel (EC2) vulnerabilities | Ubuntu security notices
-
http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
Oracle Linux Bulletin - January 2016
-
http://www.mandriva.com/security/advisories?name=MDVSA-2015:058
mandriva.com
-
http://www.ubuntu.com/usn/USN-2517-1
USN-2517-1: Linux kernel (Utopic HWE) vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
[security-announce] SUSE-SU-2015:0736-1: important: Security update for
-
http://www.ubuntu.com/usn/USN-2516-1
USN-2516-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.openwall.com/lists/oss-security/2014/12/25/4
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html
[security-announce] openSUSE-SU-2015:0714-1: important: Security update
-
http://www.ubuntu.com/usn/USN-2492-1
USN-2492-1: Linux kernel vulnerabilities | Ubuntu security notices
-
http://www.ubuntu.com/usn/USN-2493-1
USN-2493-1: Linux kernel (OMAP4) vulnerabilities | Ubuntu security notices
-
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
[security-announce] SUSE-SU-2015:0812-1: important: Security update for
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html
[SECURITY] Fedora 20 Update: kernel-3.17.8-200.fc20
-
http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html
[SECURITY] Fedora 21 Update: kernel-3.17.8-300.fc21
Jump to