CVE-2014-9585 The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR p...
LowCVSS 2.1
EPSS 0.56%
- Published
- Updated
- Exploit status
- No public exploit known
Description
The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| debian/linux(Debian:12) | < 3.16.7-ckt4-1 | 3.16.7-ckt4-1 |
| debian/linux(Debian:13) | < 3.16.7-ckt4-1 | 3.16.7-ckt4-1 |
| debian/linux(Debian:14) | < 3.16.7-ckt4-1 | 3.16.7-ckt4-1 |
| Linux kernel | <= 3.18.2 | No fix listed |
| redhat enterprise linux aus | = 6.6 | No fix listed |
| redhat enterprise linux desktop | = 6.0 | No fix listed |
| redhat enterprise linux desktop | = 7.0 | No fix listed |
| redhat enterprise linux eus | = 6.6 | No fix listed |
| redhat enterprise linux server | = 6.0 | No fix listed |
| redhat enterprise linux server | = 7.0 | No fix listed |
| redhat enterprise linux server aus | = 7.3 | No fix listed |
| redhat enterprise linux server aus | = 7.4 | No fix listed |
| redhat enterprise linux server aus | = 7.6 | No fix listed |
| redhat enterprise linux server aus | = 7.7 | No fix listed |
| redhat enterprise linux server eus | = 7.1 | No fix listed |
| redhat enterprise linux server eus | = 7.2 | No fix listed |
| redhat enterprise linux server eus | = 7.3 | No fix listed |
| redhat enterprise linux server eus | = 7.4 | No fix listed |
| redhat enterprise linux server eus | = 7.5 | No fix listed |
| redhat enterprise linux server eus | = 7.6 | No fix listed |
| redhat enterprise linux server eus | = 7.7 | No fix listed |
| redhat enterprise linux server tus | = 6.6 | No fix listed |
| redhat enterprise linux server tus | = 7.3 | No fix listed |
| redhat enterprise linux server tus | = 7.6 | No fix listed |
| redhat enterprise linux server tus | = 7.7 | No fix listed |
Show 17 more
| Product | Affected versions | Fixed in |
|---|---|---|
| redhat enterprise linux workstation | = 6.0 | No fix listed |
| redhat enterprise linux workstation | = 7.0 | No fix listed |
| openSUSE evergreen | = 11.4 | No fix listed |
| opensuse | = 13.1 | No fix listed |
| SUSE linux enterprise desktop | = 12 | No fix listed |
| SUSE linux enterprise real time extension | = 11-sp3 | No fix listed |
| SUSE linux enterprise server | = 11-sp1 | No fix listed |
| SUSE linux enterprise server | = 11-sp2 | No fix listed |
| SUSE linux enterprise server | = 12 | No fix listed |
| SUSE linux enterprise software development kit | = 12 | No fix listed |
| SUSE linux enterprise workstation extension | = 12 | No fix listed |
| fedoraproject fedora | = 21 | No fix listed |
| debian linux | = 7.0 | No fix listed |
| debian linux | = 8.0 | No fix listed |
| Canonical Ubuntu Linux | = 12.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.04 | No fix listed |
| Canonical Ubuntu Linux | = 14.10 | No fix listed |
References
- Ubuntu CVE tracker vendor-advisory
- USN-2513-1 vendor-advisory
- USN-2514-1 vendor-advisory
- USN-2515-1 vendor-advisory
- USN-2516-1 vendor-advisory
- USN-2517-1 vendor-advisory
- USN-2518-1 vendor-advisory
- www.cve.org
- Debian Security Tracker CVE-2014-9585 vendor-advisory
- git.kernel.org
- git.kernel.org
- FEDORA-2015-0937 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0178 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0481 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:0566 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0652 mailing-list third-party-advisory vendor-advisory
- openSUSE-SU-2015:0714 mailing-list third-party-advisory vendor-advisory
- SUSE-SU-2015:0736 mailing-list third-party-advisory vendor-advisory
- RHSA-2015:1081 third-party-advisory vendor-advisory
- RHSA-2015:1778 third-party-advisory vendor-advisory
- RHSA-2015:1787 third-party-advisory vendor-advisory
- v0ids3curity.blogspot.in broken-link
- DSA-3170 third-party-advisory vendor-advisory
- MDVSA-2015:058 third-party-advisory vendor-advisory
- [oss-security] 20141209 PIE bypass using VDSO ASLR weakness exploit mailing-list third-party-advisory
- [oss-security] 20150109 Re: PIE bypass using VDSO ASLR weakness - Linux kernel mailing-list third-party-advisory
- 71990 third-party-advisory vdb-entry
- USN-2513-1 third-party-advisory vendor-advisory
- USN-2514-1 third-party-advisory vendor-advisory
- USN-2515-1 third-party-advisory vendor-advisory
- USN-2516-1 third-party-advisory vendor-advisory
- USN-2517-1 third-party-advisory vendor-advisory
- USN-2518-1 third-party-advisory vendor-advisory