Improper privilege management in Linux kernel

1) Improper privilege management

EUVDB-ID: #VU92514

Risk: Low

CVSSv4.0: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Clear]

CVE-ID: CVE-2014-3153

CWE-ID: CWE-269 - Improper Privilege Management

Exploit availability: Yes

Description

The vulnerability allows a local user to execute arbitrary code.

The vulnerability exists due to improper privilege management error within the futex_requeue() and futex_wait_requeue_pi() functions in kernel/futex.c. A local user can execute arbitrary code.

Mitigation

Install update from vendor's repository.

Vulnerable software versions

Linux kernel: All versions

CPE2.3

• cpe:2.3:o:linux_foundation:linux_kernel:*:*:*:*:*:*:*:*

External links

https://openwall.com/lists/oss-security/2014/06/05/24
https://www.openwall.com/lists/oss-security/2014/06/05/22
https://openwall.com/lists/oss-security/2014/06/06/20
https://bugzilla.redhat.com/show_bug.cgi?id=1103626
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8
https://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e9c243a5a6de0be8e584c604d353412584b592f8
https://secunia.com/advisories/59153
https://secunia.com/advisories/59092
https://secunia.com/advisories/59029
https://linux.oracle.com/errata/ELSA-2014-3038.html
https://secunia.com/advisories/58500
https://linux.oracle.com/errata/ELSA-2014-3039.html
https://www.securityfocus.com/bid/67906
https://linux.oracle.com/errata/ELSA-2014-3037.html
https://secunia.com/advisories/58990
https://secunia.com/advisories/59309
https://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
https://secunia.com/advisories/59599
https://linux.oracle.com/errata/ELSA-2014-0771.html
https://secunia.com/advisories/59262
https://secunia.com/advisories/59386
https://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
https://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
https://www.exploit-db.com/exploits/35370
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
https://www.securitytracker.com/id/1030451
https://rhn.redhat.com/errata/RHSA-2014-0800.html
https://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
https://www.ubuntu.com/usn/USN-2240-1
https://www.ubuntu.com/usn/USN-2237-1
https://www.debian.org/security/2014/dsa-2949
https://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
https://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
https://www.openwall.com/lists/oss-security/2021/02/01/4
https://github.com/elongl/CVE-2014-3153
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html
https://www.openwall.com/lists/oss-security/2021/02/01/4

Q & A

Can this vulnerability be exploited remotely?

No. This vulnerability can be exploited locally. The attacker should have authentication credentials and successfully authenticate on the system.

Is there known malware, which exploits this vulnerability?

Yes. This vulnerability is being exploited in the wild.