#VU41004 Permissions, Privileges, and Access Controls in Linux kernel and Google Android - CVE-2014-9322

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU41004

#VU41004 Permissions, Privileges, and Access Controls in Linux kernel and Google Android - CVE-2014-9322

Published: December 17, 2014 / Updated: June 17, 2021


Vulnerability identifier: #VU41004
Vulnerability risk: High
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:P/U:Amber
CVE-ID: CVE-2014-9322
CWE-ID: CWE-264
Exploitation vector: Remote access
Exploit availability: Public exploit is available
Vulnerable software:
Linux kernel
Google Android
Software vendor:
Linux Foundation
Google

Description

The vulnerability allows a remote non-authenticated attacker to execute arbitrary code.

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.


Remediation

Install update from vendor's website.

External links