CVE-2014-9322

moderate-risk
Published 2014-12-17

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

Do I need to act?

~
5.2% chance of exploitation in next 30 days
EPSS score — moderate exploit probability
-
Not on CISA KEV list
No confirmed active exploitation reported to CISA
!
2 public exploits available
44205, 36266
?
Patch status unknown
Check vendor advisories for fix availability and mitigation guidance
7
CVSS 7.8/10 High
LOCAL / LOW complexity

Affected Products (7)

Affected Vendors

Suse Linux Google Canonical Opensuse Redhat

References (44)

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=...
Mailing List http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
Mailing List http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
Mailing List http://marc.info/?l=bugtraq&m=142722450701342&w=2
Mailing List http://marc.info/?l=bugtraq&m=142722544401658&w=2
Broken Link http://osvdb.org/show/osvdb/115919
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2014-1998.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2014-2008.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2014-2028.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2014-2031.html
Third Party Advisory http://rhn.redhat.com/errata/RHSA-2015-0009.html
Broken Link http://secunia.com/advisories/62336
Patch http://source.android.com/security/bulletin/2016-04-02.html
Exploit http://www.exploit-db.com/exploits/36266
Mailing List http://www.openwall.com/lists/oss-security/2014/12/15/6
Third Party Advisory http://www.ubuntu.com/usn/USN-2491-1
Third Party Advisory http://www.zerodayinitiative.com/advisories/ZDI-16-170
Issue Tracking https://bugzilla.redhat.com/show_bug.cgi?id=1172806
Patch https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f89444...
and 24 more references
46
/ 100
moderate-risk
Severity 24/34 · High
Exploitability 8/34 · Low
Exposure 14/34 · Moderate