CVE-2014-3153
HIGH
7,8
Source: [email protected]
Attack Vector: local
Attack Complexity: low
Privileges Required: low
User Interaction: none
Scope: unchanged
Confidentiality: high
Integrity: high
Availability: high
HIGH
7,2
Source: [email protected]
Access Vector: local
Access Complexity: low
Authentication: none
Confidentiality: complete
Integrity: complete
Availability: complete
Description
AI Translation Available
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
EPSS (Exploit Prediction Scoring System)
Trend Analysis
EPSS (Exploit Prediction Scoring System)
Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.
EPSS Score
0,7136
Percentile
1,0th
Updated
EPSS Score Trend (Last 90 Days)
Exploit
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - …
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation
View Exploit Code →
Operating System
Linux Enterprise Server by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
From
3.13
(inclusive)
To
3.14.6
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
From
3.5
(inclusive)
To
3.10.42
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise Real Time Extension by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise Desktop by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux by Oracle
CPE Identifier
View Detailed Analysis
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
To
3.2.60
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
From
3.11
(inclusive)
To
3.12.22
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise High Availability Extension by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Kernel by Linux
Version Range Affected
From
3.3
(inclusive)
To
3.4.92
(exclusive)
CPE Identifier
View Detailed Analysis
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Enterprise Linux Server Aus by Redhat
CPE Identifier
View Detailed Analysis
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise Server by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Ubuntu Linux by Canonical
CPE Identifier
View Detailed Analysis
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux by Oracle
CPE Identifier
View Detailed Analysis
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Opensuse by Opensuse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise Server by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
Common Platform Enumeration - Standardized vulnerability identification
Operating System
Linux Enterprise Server by Suse
CPE Identifier
View Detailed Analysis
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
Common Platform Enumeration - Standardized vulnerability identification
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014…
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh…
http://linux.oracle.com/errata/ELSA-2014-0771.html
http://linux.oracle.com/errata/ELSA-2014-3037.html
http://linux.oracle.com/errata/ELSA-2014-3038.html
http://linux.oracle.com/errata/ELSA-2014-3039.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
http://openwall.com/lists/oss-security/2014/06/05/24
http://openwall.com/lists/oss-security/2014/06/06/20
http://rhn.redhat.com/errata/RHSA-2014-0800.html
https://bugzilla.redhat.com/show_bug.cgi?id=1103626
http://secunia.com/advisories/58500
http://secunia.com/advisories/58990
http://secunia.com/advisories/59029
http://secunia.com/advisories/59092
http://secunia.com/advisories/59153
http://secunia.com/advisories/59262
http://secunia.com/advisories/59309
http://secunia.com/advisories/59386
http://secunia.com/advisories/59599
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html
https://github.com/elongl/CVE-2014-3153
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fb…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a2…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3ea…
https://www.openwall.com/lists/oss-security/2021/02/01/4
http://www.debian.org/security/2014/dsa-2949
http://www.exploit-db.com/exploits/35370
http://www.openwall.com/lists/oss-security/2014/06/05/22
http://www.openwall.com/lists/oss-security/2021/02/01/4
http://www.securityfocus.com/bid/67906
http://www.securitytracker.com/id/1030451
http://www.ubuntu.com/usn/USN-2237-1
http://www.ubuntu.com/usn/USN-2240-1
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh…
http://linux.oracle.com/errata/ELSA-2014-0771.html
http://linux.oracle.com/errata/ELSA-2014-3037.html
http://linux.oracle.com/errata/ELSA-2014-3038.html
http://linux.oracle.com/errata/ELSA-2014-3039.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
http://openwall.com/lists/oss-security/2014/06/05/24
http://openwall.com/lists/oss-security/2014/06/06/20
http://rhn.redhat.com/errata/RHSA-2014-0800.html
https://bugzilla.redhat.com/show_bug.cgi?id=1103626
http://secunia.com/advisories/58500
http://secunia.com/advisories/58990
http://secunia.com/advisories/59029
http://secunia.com/advisories/59092
http://secunia.com/advisories/59153
http://secunia.com/advisories/59262
http://secunia.com/advisories/59309
http://secunia.com/advisories/59386
http://secunia.com/advisories/59599
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html
https://github.com/elongl/CVE-2014-3153
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fb…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a2…
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3ea…
https://www.openwall.com/lists/oss-security/2021/02/01/4
http://www.debian.org/security/2014/dsa-2949
http://www.exploit-db.com/exploits/35370
http://www.openwall.com/lists/oss-security/2014/06/05/22
http://www.openwall.com/lists/oss-security/2021/02/01/4
http://www.securityfocus.com/bid/67906
http://www.securitytracker.com/id/1030451
http://www.ubuntu.com/usn/USN-2237-1
http://www.ubuntu.com/usn/USN-2240-1