NetSight
IP …
low2.1

CVE-2014-9584

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference …

Impact

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.18.2
RedhatEnterprise Linux Aus
Version 6.6
RedhatEnterprise Linux Desktop
Versions 6.0, 7.0
RedhatEnterprise Linux Eus
Version 6.6
RedhatEnterprise Linux Server
Versions 6.0, 7.0
RedhatEnterprise Linux Server Aus
Versions 7.3, 7.4, 7.6, 7.7
RedhatEnterprise Linux Server Eus
Versions 7.1, 7.2, 7.3, 7.4, 7.5, 7.6
RedhatEnterprise Linux Server Tus
Versions 6.6, 7.3, 7.6, 7.7
RedhatEnterprise Linux Workstation
Versions 6.0, 7.0
OpensuseEvergreen
Version 11.4
OpensuseOpensuse
Version 13.1
SuseLinux Enterprise Desktop
Version 12

Weakness classification

CWE-20

References