CVE-2014-9644

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

Weakness

The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.

Affected Software

Potential Mitigations

Related Attack Patterns

• https://cwe.mitre.org/data/definitions/122.html
• https://cwe.mitre.org/data/definitions/233.html
• https://cwe.mitre.org/data/definitions/58.html

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4943ba16bbc2db05115707b3ff7b4874e9e3c560
• http://rhn.redhat.com/errata/RHSA-2016-0068.html
• http://www.debian.org/security/2015/dsa-3170
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.18.5
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:057
• http://www.mandriva.com/security/advisories?name=MDVSA-2015:058
• http://www.openwall.com/lists/oss-security/2015/01/24/4
• http://www.oracle.com/technetwork/topics/security/linuxbulletinjan2016-2867209.html
• http://www.oracle.com/technetwork/topics/security/linuxbulletinoct2015-2719645.html
• http://www.securityfocus.com/bid/72320
• http://www.ubuntu.com/usn/USN-2513-1
• http://www.ubuntu.com/usn/USN-2514-1
• http://www.ubuntu.com/usn/USN-2543-1
• http://www.ubuntu.com/usn/USN-2544-1
• http://www.ubuntu.com/usn/USN-2545-1
• http://www.ubuntu.com/usn/USN-2546-1
• https://bugzilla.redhat.com/show_bug.cgi?id=1190546
• https://github.com/torvalds/linux/commit/4943ba16bbc2db05115707b3ff7b4874e9e3c560
• https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu