NetSight
IP …
medium5.5Known exploitedPublic exploit code

CVE-2014-0196

Linux Kernel Race Condition Vulnerability

Exploited in the wild

This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2023-05-12. Federal due date: 2023-06-02.

The impacted product is end-of-life and should be disconnected if still in use.

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
after 2.6.31 before 3.2.59
from 3.3 before 3.4.91
from 3.5 before 3.10.40
from 3.11 before 3.12.20
from 3.13 before 3.14.4
Version 2.6.31
DebianDebian Linux
Versions 6.0, 7.0
RedhatEnterprise Linux
Version 6.0
RedhatEnterprise Linux Eus
Versions 6.3, 6.4
RedhatEnterprise Linux Server Eus
Version 6.3
SuseSuse Linux Enterprise Desktop
Version 11
SuseSuse Linux Enterprise High Availability Extension
Version 11
SuseSuse Linux Enterprise Server
Version 11
OracleLinux
Version 6
CanonicalUbuntu Linux
Versions 10.04, 12.04, 12.10, 13.10, 14.04
F5Big-Ip Access Policy Manager
from 11.1.0 through 11.5.1
F5Big-Ip Advanced Firewall Manager
from 11.3.0 through 11.5.1

Weakness classification

CWE-362

References