NetSight
IP …
low2.1

CVE-2014-9644

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenth…

Impact

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

Affected products

VendorProductAffected versions
LinuxLinux Kernel
before 3.18.5
DebianDebian Linux
Versions 7.0, 8.0
CanonicalUbuntu Linux
Versions 12.04, 14.04, 14.10
OracleLinux
Versions 5, 6, 7

Weakness classification

CWE-269

References