SB2014102401 - Multiple vulnerabilities in Linux Kernel
Published: October 24, 2014 Updated: May 23, 2018
Security Bulletin ID
SB2014102401
Severity
Low
Patch available
YES
Number of vulnerabilities
2
Exploitation vector
Adjecent network
Highest impact
Code execution
Breakdown by Severity
- Low
- Medium
- High
- Critical
Description
This security bulletin contains information about 2 secuirty vulnerabilities.
1) Privilege escalation (CVE-ID: CVE-2014-9922)
The vulnerability allows a local attacker to gain elevated privileges on the target system.The weakness exists due to improper privileges and access controls. A local attacker can provide a large filesystem stack that includes an overlayfs layer, related to fs/ecryptfs/main.c and fs/overlayfs/super.c and gain root privileges on the system.
2) Information disclosure (CVE-ID: CVE-2014-8134)
The vulnerability allows an adjacent attacker to obtain potentially sensitive information on the target system.The weakness exists in the paravirt_ops_setup function in arch/x86/kernel/kvm.c due to use of an improper paravirt_enabled setting for KVM guest kernels. An adjacent attacker can submit a specially crafted application that reads a 16-bit value, bypass the ASLR protection mechanism and gain access to potentially sensitive information.
Remediation
Install update from vendor's website.