Vulnerability DatabaseCVE-2014-1737
Mend.io Vulnerability Database
The largest open source vulnerability database
What is a Vulnerability ID?
New vulnerability? Tell us about it!
CVE-2014-1737
May 11, 2014
The raw_cmd_copyin function in drivers/block/floppy.c in the Linux kernel through 3.14.3 does not properly handle error conditions during processing of an FDRAWCMD ioctl call, which allows local users to trigger kfree operations and gain privileges by leveraging write access to a /dev/fd device.
Related Resources (22)
http://secunia.com/advisories/59406
http://secunia.com/advisories/59309
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=ef87dbe7614341c2e7bfe8d32fcb7028cc97442c
https://people.canonical.com/~ubuntu-security/cve/CVE-2014-1737
https://bugzilla.redhat.com/show_bug.cgi?id=1094299
http://rhn.redhat.com/errata/RHSA-2014-0801.html
http://www.debian.org/security/2014/dsa-2928
http://secunia.com/advisories/59599
http://secunia.com/advisories/59262
http://www.openwall.com/lists/oss-security/2014/05/09/2
https://security-tracker.debian.org/tracker/CVE-2014-1737
https://github.com/torvalds/linux/commit/ef87dbe7614341c2e7bfe8d32fcb7028cc97442c
http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.html
http://www.securitytracker.com/id/1030474
http://www.securityfocus.com/bid/67300
http://linux.oracle.com/errata/ELSA-2014-3043.html
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=ef87dbe7614341c2e7bfe8d32fcb7028cc97442c
http://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.html
https://access.redhat.com/security/cve/CVE-2014-1737
http://linux.oracle.com/errata/ELSA-2014-0771.html
http://rhn.redhat.com/errata/RHSA-2014-0800.html
http://www.debian.org/security/2014/dsa-2926
Do you need more information?
Contact Us
CVSS v4
Base Score:
8.6
Attack Vector
LOCAL
Attack Complexity
LOW
Attack Requirements
NONE
Privileges Required
NONE
User Interaction
NONE
Vulnerable System Confidentiality
HIGH
Vulnerable System Integrity
HIGH
Vulnerable System Availability
HIGH
Subsequent System Confidentiality
NONE
Subsequent System Integrity
NONE
Subsequent System Availability
NONE
CVSS v3
Base Score:
8.4
Attack Vector
LOCAL
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality
HIGH
Integrity
HIGH
Availability
HIGH
CVSS v2
Base Score:
7.2
Access Vector
LOCAL
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
Weakness Type (CWE)
Improper Check for Unusual or Exceptional Conditions
CWE-754
EPSS
Base Score:
0.04