Vulnerability CVE-2014-3153: Information

Description

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Severity: HIGH (7.2)

Fixed packages

References to Advisories, Solutions, and Tools

1. Affected configurations:

   1. Configuration 1

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

      Start including

      3.3

      End excliding

      3.4.92

      ---

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

      Start including

      3.5

      End excliding

      3.10.42

      ---

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

      Start including

      3.13

      End excliding

      3.14.6

      ---

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

      Start including

      3.11

      End excliding

      3.12.22

      ---

      cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

      End excliding

      3.2.60

      ---

      Configuration 2

      cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*

      ---

      Configuration 3

      cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*

      ---

      cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*

      ---

      cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*

      ---