CVE-2014-9322 arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by tri...
HighCVSS 7.8
EPSS 1.5%
- Published
- Updated
- Exploit status
- No public exploit known
Description
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
| debian/linux(Debian:13) | < 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
| debian/linux(Debian:14) | < 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
| Linux kernel | < 3.2.65 | 3.2.65 |
| Linux kernel | >= 3.3, < 3.4.106 | 3.4.106 |
| Linux kernel | >= 3.5, < 3.10.62 | 3.10.62 |
| Linux kernel | >= 3.11, < 3.12.35 | 3.12.35 |
| Linux kernel | >= 3.13, < 3.14.26 | 3.14.26 |
| Linux kernel | >= 3.15, < 3.16.35 | 3.16.35 |
| Linux kernel | >= 3.17, < 3.17.5 | 3.17.5 |
| redhat enterprise linux eus | = 5.6 | No fix listed |
| Canonical Ubuntu Linux | = 10.04 | No fix listed |
| openSUSE evergreen | = 11.4 | No fix listed |
| suse linux enterprise server | = 10-sp4 | No fix listed |
| Google Android | = 6.0 | No fix listed |
| Google Android | = 6.0.1 | No fix listed |
References
- Debian Security Tracker CVE-2014-9322 vendor-advisory
- git.kernel.org
- openSUSE-SU-2015:0566 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0736 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0812 mailing-list third-party-advisory vendor-advisory
- HPSBGN03285 mailing-list third-party-advisory vendor-advisory
- HPSBGN03282 mailing-list third-party-advisory vendor-advisory
- 115919 broken-link vdb-entry
- RHSA-2014:1998 third-party-advisory vendor-advisory
- RHSA-2014:2008 third-party-advisory vendor-advisory
- RHSA-2014:2028 third-party-advisory vendor-advisory
- RHSA-2014:2031 third-party-advisory vendor-advisory
- RHSA-2015:0009 third-party-advisory vendor-advisory
- 62336 broken-link third-party-advisory
- source.android.com patch third-party-advisory
- 36266 exploit third-party-advisory vdb-entry
- [oss-security] 20141215 Linux kernel: multiple x86_64 vulnerabilities mailing-list patch third-party-advisory
- USN-2491-1 third-party-advisory vendor-advisory
- www.zerodayinitiative.com third-party-advisory vdb-entry
- bugzilla.redhat.com issue-tracking patch third-party-advisory
- github.com patch third-party-advisory
- help.joyent.com permissions-required third-party-advisory
- www.kernel.org mailing-list patch vendor-advisory