NetSight
IP …
medium6.9

CVE-2014-8159

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of Us…

Impact

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
from 2.6.12 before 3.2.69
from 3.3 before 3.4.108
from 3.5 before 3.10.75
from 3.11 before 3.12.41
from 3.13 before 3.14.39
from 3.15 before 3.16.35
CanonicalUbuntu Linux
Versions 10.04, 12.04, 14.04, 14.10
DebianDebian Linux
Versions 7.0, 8.0

Weakness classification

CWE-264

References