CVE-2014-0069
published 2014-02-28CVE-2014-0069: The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the…
PriorityP427high7.2CVSS 2.0
AVLACLAuNCCICAC
EPSS
0.41%
34.6th percentile
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
Affected
22 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.13.6-1 (bookworm) | linux 3.13.6-1 (bookworm) |
| linux | linux_kernel | < 3.2.57 | 3.2.57 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 0 < 3.13.6-1 | 3.13.6-1 |
| linux | linux_kernel | >= 3.11 < 3.12.14 | 3.12.14 |
| linux | linux_kernel | >= 3.13 < 3.13.6 | 3.13.6 |
| linux | linux_kernel | >= 3.3 < 3.4.83 | 3.4.83 |
| linux | linux_kernel | >= 3.5 < 3.10.33 | 3.10.33 |
| msrc | azure_linux_3.0_arm | — | — |
| msrc | azure_linux_3.0_x64 | — | — |
| msrc | cbl_mariner_2.0_arm | — | — |
| msrc | cbl_mariner_2.0_x64 | — | — |
| redhat | enterprise_linux_desktop | — | — |
| redhat | enterprise_linux_eus | — | — |
| redhat | enterprise_linux_server | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| redhat | enterprise_linux_server_tus | — | — |
| redhat | enterprise_linux_workstation | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv2.07.2HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
osv7.2HIGH
vendor_ubuntu7.4HIGH
vendor_debian7.2HIGH
vendor_msrc7.2HIGH
vendor_redhat7.2HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-mg5h-jxw2-63w8: The cifs_iovec_write function in fs/cifs/file
ghsa_unreviewed·2022-05-13
CVE-2014-0069 [HIGH] CWE-119 GHSA-mg5h-jxw2-63w8: The cifs_iovec_write function in fs/cifs/file
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
Kernel
Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
kernel_security·2014-03-11·CVSS 7.2
CVE-2014-0069 [HIGH] Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
Merge branch 'for-next' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French:
"A fix for the problem which Al spotted in cifs_writev and a followup
(noticed when fixing CVE-2014-0069) patch to ensure that cifs never
sends more than the smb frame length over the socket (as we saw with
that cifs_iovec_write problem that Jeff fixed last month)"
* 'for-next' of git://git.samba.org/sfrench/cifs-2.6:
cifs: mask off top byte in get_rfc1002_length()
cifs: sanity check length of data to send before sending
CIFS: Fix wrong pos argument of cifs_find_lock_conflict
OSV
CVE-2014-0069: The cifs_iovec_write function in fs/cifs/file
osv·2014-02-28·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069: The cifs_iovec_write function in fs/cifs/file
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
Kernel
Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6
kernel_security·2014-02-17·CVSS 7.2
CVE-2014-0069 [HIGH] Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6
Merge branch 'for-linus' of git://git.samba.org/sfrench/cifs-2.6
Pull CIFS fixes from Steve French:
"Three cifs fixes, the most important fixing the problem with passing
bogus pointers with writev (CVE-2014-0069).
Two additional cifs fixes are still in review (including the fix for
an append problem which Al also discovered)"
* 'for-linus' of git://git.samba.org/sfrench/cifs-2.6:
CIFS: Fix too big maxBuf size for SMB3 mounts
cifs: ensure that uncached writes handle unmapped areas correctly
[CIFS] Fix cifsacl mounts over smb2 to not call cifs
Kernel
cifs: ensure that uncached writes handle unmapped areas correctly
kernel_security·2014-02-14·CVSS 7.2
CVE-2014-0069 [HIGH] cifs: ensure that uncached writes handle unmapped areas correctly
cifs: ensure that uncached writes handle unmapped areas correctly
It's possible for userland to pass down an iovec via writev() that has a
bogus user pointer in it. If that happens and we're doing an uncached
write, then we can end up getting less bytes than we expect from the
call to iov_iter_copy_from_user. This is CVE-2014-0069
cifs_iovec_write isn't set up to handle that situation however. It'll
blindly keep chugging through the page array and not filling those pages
with anything useful. Worse yet, we'll later end up with a negative
number in wdata->tailsz, which will confuse the sending routines and
cause an oops at the very least.
Fix this by having the copy phase of cifs_iovec_write stop copying data
in this situation and send the last write as a short one. At the same
time, we
Microsoft
CVE-2014-0069: NIST NVD Details: https://nvd
vendor_msrc·2024-06-11·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069: NIST NVD Details: https://nvd
NIST NVD Details: https://nvd.nist.gov/vuln/detail/CVE-2014-0069
Mariner: Mariner
[email protected]: [email protected]
Customer Action Required: Yes
Remediation: kernel
Reference: https://nvd.nist.gov/vuln/detail/CVE-2014-0069
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-05-27·CVSS 4.9
CVE-2013-4483 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
(CVE-2014-0196)
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-05-26·CVSS 4.9
CVE-2013-4483 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A flaw was discovered in the Linux kernel's IPC reference counting. An
unprivileged local user could exploit this flaw to cause a denial of
service (OOM system crash). (CVE-2013-4483)
Al Viro discovered an error in how CIFS in the
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, w
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires
Ubuntu
Linux kernel (Quantal HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Quantal HWE) vulnerabilities
Title: Linux kernel (Quantal HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Jouni Malinen reported a flaw in the handling of fragmentation in the
mac8Linux subsystem of the kernel. A remote attacker could exploit this
flaw to obtain potential sensitive cleartext information by reading
packe
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-04-26·CVSS 7.4
CVE-2014-0049 [HIGH] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine (KVM) subsystem of the
Linux kernel. A guest OS user could exploit this flaw to execute arbitrary
code on the host OS. (CVE-2014-0049)
Al Viro discovered an error in how CIFS in the Linux kernel handles
uncached write operations. An unprivileged local user could exploit this
flaw to cause a denial of service (system crash), obtain sensitive
information from kernel memory, or possibly gain privileges.
(CVE-2014-0069)
Jouni Malinen reported a flaw in the handling of fragmentation in the
mac8Linux subsystem of the kernel. A remote attacker could exploit this
flaw to obtain potential sensitive cleartext information by reading
packets
Red Hat
kernel: cifs: incorrect handling of bogus user pointers during uncached writes
vendor_redhat·2014-02-14·CVSS 7.2
CVE-2014-0069 [HIGH] kernel: cifs: incorrect handling of bogus user pointers during uncached writes
kernel: cifs: incorrect handling of bogus user pointers during uncached writes
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
Statement: This issue did not affect the versions of Linux kernel as shipped with Red Hat Enterprise Linux 5.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 7) - Not affected
Debian
CVE-2014-0069: linux - The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13...
vendor_debian·2014·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069: linux - The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13...
The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.
Scope: local
bookworm: resolved (fixed in 3.13.6-1)
bullseye: resolved (fixed in 3.13.6-1)
forky: resolved (fixed in 3.13.6-1)
sid: resolved (fixed in 3.13.6-1)
trixie: resolved (fixed in 3.13.6-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-6549 OpenJDK: incorrect class loader permission check in ClassLoader getParent() (Libraries, 8055314)
bugzilla·2015-01-19·CVSS 10.0
CVE-2014-6549 [CRITICAL] CVE-2014-6549 OpenJDK: incorrect class loader permission check in ClassLoader getParent() (Libraries, 8055314)
CVE-2014-6549 OpenJDK: incorrect class loader permission check in ClassLoader getParent() (Libraries, 8055314)
It was discovered that the java.lang.ClassLoader's getParent() method performed an incorrect class loader permission check. An untrusted Java application or applet could use this flaw to bypass Java sandbox restrictions.
Discussion:
Public now via Oracle Critical Patch Update - January 2015. Fixed in Oracle Java SE 8u31.
External References:
http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html#AppendixJAVA
---
This issue has been addressed in the following products:
Red Hat Enterprise Linux 6
Via RHSA-2015:0069 https://rhn.redhat.com/errata/RHSA-2015-0069.html
---
Upstream OpenJDK commit:
http://hg.openjdk.java.net/jdk8u/jdk8u/jdk/rev/fc4646e5a11f
Bugzilla
CVE-2014-0069 kernel: cifs: incorrect handling of bogus user pointers during uncached writes
bugzilla·2014-02-12·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069 kernel: cifs: incorrect handling of bogus user pointers during uncached writes
CVE-2014-0069 kernel: cifs: incorrect handling of bogus user pointers during uncached writes
A flaw was found in the way cifs handled iovecs with bogus pointers
userland passed down via writev() during uncached writes.
An unprivileged local user with access to cifs share could use this flaw
to crash the system or leak kernel memory. Privilege escalation cannot be
ruled out (since memory corruption is involved), but is unlikely.
The default cache settings for cifs mounts on Red Hat Enterprise Linux
prohibit successful exploitation of this issue.
Acknowledgements:
Red Hat would like to thank Al Viro for reporting this issue.
Discussion:
Patches have been reported to the linux-cifs mailing list:
http://article.gmane.org/gmane.linux.kernel.cifs/9401
http://article.gmane.org/gmane.linux
Bugzilla
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-rawhide]
bugzilla·2014-02-07·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-rawhide]
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-rawhide]
Al Viro discovered the following problem in cifs.ko while overhauling some of the VFS layer write code:
> Take a look at cifs_iovec_writev(). We have decided that
> the next chunk to send should cover nr_pages worth of data, allocated
> the pages and
> save_len = cur_len;
> for (i = 0; i copied = min_t(const size_t, cur_len, PAGE_SIZE);
> copied = iov_iter_copy_from_user(wdata->pages[i], &it,
> 0, copied);
> cur_len -= copied;
> iov_iter_advance(&it, copied);
> }
> cur_len = save_len - cur_len;
> tried to copy from iovec into said pages. What happens if iovec spans
> an munmapped area? It'll copy as much as it can and from that point on
> iov_iter_copy_from_user() will be returning 0. A
Bugzilla
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-19]
bugzilla·2014-02-07·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-19]
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-19]
+++ This bug was initially created as a clone of Bug #1062584 +++
Al Viro discovered the following problem in cifs.ko while overhauling some of the VFS layer write code:
> Take a look at cifs_iovec_writev(). We have decided that
> the next chunk to send should cover nr_pages worth of data, allocated
> the pages and
> save_len = cur_len;
> for (i = 0; i copied = min_t(const size_t, cur_len, PAGE_SIZE);
> copied = iov_iter_copy_from_user(wdata->pages[i], &it,
> 0, copied);
> cur_len -= copied;
> iov_iter_advance(&it, copied);
> }
> cur_len = save_len - cur_len;
> tried to copy from iovec into said pages. What happens if iovec spans
> an munmapped area? It'll copy as much as it can and from th
Bugzilla
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-20]
bugzilla·2014-02-07·CVSS 7.2
CVE-2014-0069 [HIGH] CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-20]
CVE-2014-0069 kernel: cifs: uncached writes don't handle bad user addresses correctly [fedora-20]
+++ This bug was initially created as a clone of Bug #1062578 +++
Al Viro discovered the following problem in cifs.ko while overhauling some of the VFS layer write code:
> Take a look at cifs_iovec_writev(). We have decided that
> the next chunk to send should cover nr_pages worth of data, allocated
> the pages and
> save_len = cur_len;
> for (i = 0; i copied = min_t(const size_t, cur_len, PAGE_SIZE);
> copied = iov_iter_copy_from_user(wdata->pages[i], &it,
> 0, copied);
> cur_len -= copied;
> iov_iter_advance(&it, copied);
> }
> cur_len = save_len - cur_len;
> tried to copy from iovec into said pages. What happens if iovec spans
> an munmapped area? It'll copy as much as it can and from th
http://article.gmane.org/gmane.linux.kernel.cifs/9401http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483fhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0328.htmlhttp://www.openwall.com/lists/oss-security/2014/02/17/4http://www.securityfocus.com/bid/65588https://bugzilla.redhat.com/show_bug.cgi?id=1064253https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483fhttp://article.gmane.org/gmane.linux.kernel.cifs/9401http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483fhttp://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.htmlhttp://rhn.redhat.com/errata/RHSA-2014-0328.htmlhttp://www.openwall.com/lists/oss-security/2014/02/17/4http://www.securityfocus.com/bid/65588https://bugzilla.redhat.com/show_bug.cgi?id=1064253https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f
2014-02-28
Published