CVE Vulnerabilities

CVE-2014-9322

Improper Privilege Management

Published: Dec 17, 2014 | Modified: Nov 07, 2023
CVSS 3.x
7.8
HIGH
Source:
NVD
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.x
7.2 HIGH
AV:L/AC:L/Au:N/C:C/I:C/A:C
RedHat/V2
RedHat/V3
Ubuntu

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Name Vendor Start Version End Version
Linux_kernel Linux 3.15 *
Linux_kernel Linux 3.3 *
Linux_kernel Linux * *
Linux_kernel Linux 3.5 *
Linux_kernel Linux 3.11 *
Linux_kernel Linux 3.13 *
Linux_kernel Linux 3.17 *

Potential Mitigations

References