Mend.io Vulnerability Database

What is a CVE vulnerability ID? icon What is a WS vulnerability ID? icon What is an MSC vulnerability ID? icon
New vulnerability? Tell us about it!
icon

We found results for “”

CVE-2014-4014

Date: June 23, 2014

The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.

Language: C

Severity Score

Related Resources (13)

http://www.securitytracker.com/id/1030394
http://www.openwall.com/lists/oss-security/2014/06/10/4
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=23adbe12ef7d3d4195e80800ab36b37bee28cd03
https://people.canonical.com/~ubuntu-security/cve/CVE-2014-4014
http://www.securityfocus.com/bid/67988
http://secunia.com/advisories/59220
https://bugzilla.redhat.com/show_bug.cgi?id=1107966
http://www.exploit-db.com/exploits/33824
https://source.android.com/security/bulletin/2016-12-01.html
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8
https://nvd.nist.gov/vuln/detail/CVE-2014-4014
https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03
https://www.mend.io/vulnerability-database/CVE-2014-4014

Severity Score

Weakness Type (CWE)

Permissions, Privileges, and Access Control

CWE-264

CVSS v3.1

Base Score:
Attack Vector (AV): LOCAL
Attack Complexity (AC): HIGH
Privileges Required (PR): NONE
User Interaction (UI): NONE
Scope (S): UNCHANGED
Confidentiality (C): HIGH
Integrity (I): HIGH
Availability (A): HIGH

CVSS v2

Base Score:
Access Vector (AV): LOCAL
Access Complexity (AC): HIGH
Authentication (AU): NONE
Confidentiality (C): COMPLETE
Integrity (I): COMPLETE
Availability (A): COMPLETE
Additional information:

Do you need more information?

Contact Us