CVE-2014-0196
published 2014-05-07CVE-2014-0196: The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case…
PriorityP178medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
KEVITWEXPLOIT
CISA Known Exploited Vulnerabilitydue 2023-06-02
Exploited in the wild
EPSS
20.33%
97.5th percentile
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Affected
47 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | debian_linux | — | — |
| debian | debian_linux | — | — |
| debian | linux | < linux 3.14.4-1 (bookworm) | linux 3.14.4-1 (bookworm) |
| f5 | big-ip_access_policy_manager | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_advanced_firewall_manager | 11.3.0 – 11.5.1 | — |
| f5 | big-ip_analytics | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_application_acceleration_manager | 11.4.0 – 11.5.1 | — |
| f5 | big-ip_application_security_manager | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_edge_gateway | 11.1.0 – 11.3.0 | — |
| f5 | big-ip_global_traffic_manager | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_link_controller | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_local_traffic_manager | 11.1.0 – 11.5.1 | — |
| f5 | big-ip_policy_enforcement_manager | 11.3.0 – 11.5.1 | — |
| f5 | big-ip_protocol_security_module | 11.1.0 – 11.4.1 | — |
| f5 | big-ip_wan_optimization_manager | 11.1.0 – 11.3.0 | — |
| f5 | big-ip_webaccelerator | 11.1.0 – 11.3.0 | — |
| f5 | big-iq_application_delivery_controller | — | — |
| f5 | big-iq_centralized_management | — | — |
| f5 | big-iq_cloud | 4.0.0 – 4.5.0 | — |
| f5 | big-iq_cloud_and_orchestration | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →The exploit triggers the vulnerability specifically when TTY line discipline is configured with LECHO enabled and OPOST disabled (LECHO & !OPOST). Monitor for processes setting these termios flags (c_oflag &= ~OPOST; c_lflag |= ECHO) on PTY devices. ↗
- →The exploit reads /proc/kallsyms to resolve kernel symbols commit_creds and prepare_kernel_cred. Unprivileged access to /proc/kallsyms (returning non-zero addresses) is a prerequisite and indicator of exploit conditions. ↗
- →The exploit performs a large number of openpty() calls (ONEOFF_ALLOCS=200 once-off, then RUN_ALLOCS=30 per iteration) to groom kernel slab memory. Anomalous mass PTY allocation by an unprivileged process is a behavioral indicator. ↗
- →The exploit uses a race condition between a pthread writing to the slave PTY fd and a concurrent write to the master PTY fd. Look for concurrent read/write operations on PTY devices with long strings from the same unprivileged process. ↗
- →The exploit overwrites a tty_struct in kernel memory using a crafted header with magic value 0x5401 and a fake kref refcount of 0x1337. Memory forensics or kernel integrity checks may detect this corruption pattern. ↗
- →The exploit issues ioctl calls with the invalid/sentinel argument 0xdeadbeef on PTY file descriptors to trigger the corrupted tty_operations function pointer table (payload). Detect ioctl syscalls with this argument value on tty/pty devices. ↗
- →Successful exploitation results in setresuid(0,0,0) followed by execl('/bin/bash') from a previously unprivileged process. Monitor for privilege escalation events where a non-root process spawns a root shell. ↗
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv5.5MEDIUM
vulncheck5.5MEDIUM
cisa5.5MEDIUM
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
vendor_ubuntu5.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
CISA
Linux Kernel Race Condition Vulnerability
cisa·2023-05-12·CVSS 5.5
CVE-2014-0196 [MEDIUM] CWE-362 Linux Kernel Race Condition Vulnerability
Vulnerability: Linux Kernel Race Condition Vulnerability
Affected: Linux Kernel
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Notes: https://lkml.iu.edu/hypermail/linux/kernel/1609.1/02103.html; https://nvd.nist.gov/vuln/detail/CVE-2014-0196
Remediation Due Date: 2023-06-02
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-06-27·CVSS 5.5
CVE-2014-0077 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
(CVE-2014-0196)
Pinkie Pie discovered a flaw in the Linux kernel's futex subsystem. An
unprivileged local user could exploit this flaw to cause a denial of
service (system crash) or gain administrative privileges. (CVE-2014-3153)
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-05-27·CVSS 4.9
CVE-2013-4483 [MEDIUM] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
(CVE-2014-0196)
Matthew Daley reported an information leak in the floppy disk driver of the
Linux kernel. An unprivileged local user could exploit this flaw to obtain
potentially sensitive information from kernel memory. (CVE-2014-1738)
Matthew Daley reported a flaw in the handling of ioctl commands by the
floppy disk driver in the Linux kernel. An unprivileged local user could
exploit this flaw to gain administrative privileges if the floppy disk
module is loaded. (CVE-2014-1737)
A
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel (Raring HWE) vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel (Raring HWE) vulnerability
Title: Linux kernel (Raring HWE) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel (Quantal HWE) vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel (Quantal HWE) vulnerability
Title: Linux kernel (Quantal HWE) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel (EC2) vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel (EC2) vulnerability
Title: Linux kernel (EC2) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel (Saucy HWE) vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel (Saucy HWE) vulnerability
Title: Linux kernel (Saucy HWE) vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
Ubuntu
Linux kernel vulnerability
vendor_ubuntu·2014-05-06
CVE-2014-0196 Linux kernel vulnerability
Title: Linux kernel vulnerability
Summary: The system could be made to crash or run programs as an administrator.
A flaw was discovered in the Linux kernel's pseudo tty (pty) device. An
unprivileged user could exploit this flaw to cause a denial of service
(system crash) or potentially gain administrator privileges.
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which requires you to recompile and
reinstall all third party kernel modules you might have installed. If
you use linux-restricted-modules, you have to update that package as
well to get modules which work with the new kernel version. Unless you
manually uninstall
Red Hat
kernel: pty layer race condition leading to memory corruption
vendor_redhat·2014-05-01·CVSS 5.5
CVE-2014-0196 [MEDIUM] kernel: pty layer race condition leading to memory corruption
kernel: pty layer race condition leading to memory corruption
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Statement: This issue did not affect the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.
This issue affected the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 6 prior to version kernel-2.6.32-358.6.1.el6, released via RHSA-2013:0744 (https://rhn.redhat.com/errata/RHSA-2013-0744.html). That update added a backport of
Debian
CVE-2014-0196: linux - The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14...
vendor_debian·2014·CVSS 5.5
CVE-2014-0196 [MEDIUM] CVE-2014-0196: linux - The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14...
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Scope: local
bookworm: resolved (fixed in 3.14.4-1)
bullseye: resolved (fixed in 3.14.4-1)
forky: resolved (fixed in 3.14.4-1)
sid: resolved (fixed in 3.14.4-1)
trixie: resolved (fixed in 3.14.4-1)
GHSA
GHSA-xwpg-vm43-3qwm: The n_tty_write function in drivers/tty/n_tty
ghsa_unreviewed·2022-05-13
CVE-2014-0196 [MEDIUM] CWE-362 GHSA-xwpg-vm43-3qwm: The n_tty_write function in drivers/tty/n_tty
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
OSV
CVE-2014-0196: The n_tty_write function in drivers/tty/n_tty
osv·2014-05-07·CVSS 5.5
CVE-2014-0196 [MEDIUM] CVE-2014-0196: The n_tty_write function in drivers/tty/n_tty
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Kernel
n_tty: Fix n_tty_write crash when echoing in raw mode
kernel_security·2014-05-03·CVSS 5.5
CVE-2014-0196 [MEDIUM] n_tty: Fix n_tty_write crash when echoing in raw mode
n_tty: Fix n_tty_write crash when echoing in raw mode
The tty atomic_write_lock does not provide an exclusion guarantee for
the tty driver if the termios settings are LECHO & !OPOST. And since
it is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently, this may lead to crashes when
concurrect writers call pty_write. In that case the following two
writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer like follows.
If we look into tty_insert_flip_string_fixed_flag, there is:
int space = __tty_buffer_request_room(port, goal, flags);
struct tty_buffer *tb = port->buf.tail;
...
memcpy(char_buf_ptr(tb, tb->used), chars, space);
...
tb->used += space;
so the race of the two can resul
VulnCheck
Linux Kernel Race Condition Vulnerability
vulncheck·2014·CVSS 5.5
CVE-2014-0196 [MEDIUM] CWE-362 Linux Kernel Race Condition Vulnerability
Linux Kernel Race Condition Vulnerability
Linux Kernel contains a race condition vulnerability within the n_tty_write function that allows local users to cause a denial-of-service (DoS) or gain privileges via read and write operations with long strings.
Affected: Linux Kernel
Required Action: The impacted product is end-of-life and should be disconnected if still in use.
Exploitation References: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json
Exploit PoC: https://vulncheck.com/xdb/a8bbc320feca; https://vulncheck.com/xdb/dc9022508ef9; https://vulncheck.com/xdb/cd9f2a0f1fca
Remediation Due: 2023-06-02
No detection rules found.
Bugzilla
CVE-2014-0196 kernel: pty layer race condition leading to memory corruption
bugzilla·2014-05-05·CVSS 5.5
CVE-2014-0196 [MEDIUM] CVE-2014-0196 kernel: pty layer race condition leading to memory corruption
CVE-2014-0196 kernel: pty layer race condition leading to memory corruption
It is unexpected and not allowed to call TTY buffer helpers like
tty_insert_flip_string concurrently. This may lead to crashes when
ECHOing is enabled and concurrect writers call pty_write in the
meantime. In that case the two writers:
* the ECHOing from a workqueue and
* pty_write from the process
race and can overflow the corresponding TTY buffer.
An unprivileged local user could use this flaw to crash the system or,
potentially, escalate their privileges on the system.
References:
http://seclists.org/oss-sec/2014/q2/243
Discussion:
Statement:
This issue did not affect the versions of the Linux kernel packages as shipped with Red Hat Enterprise Linux 5.
This issue affected the versions of the Linux kernel
Bugzilla
CVE-2014-0196 kernel: pty layer race condition leading memory corruption [fedora-all]
bugzilla·2014-05-05·CVSS 5.5
CVE-2014-0196 [MEDIUM] CVE-2014-0196 kernel: pty layer race condition leading memory corruption [fedora-all]
CVE-2014-0196 kernel: pty layer race condition leading memory corruption [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects m
arXiv
Towards Linux Kernel Memory Safety
arxiv_fulltext·2017-10-17
Towards Linux Kernel Memory Safety
0.5cm1cm
[1]
printacmref=false
plain
[C]
Towards Linux Kernel Memory Safety
Elena Reshetova
Intel OTC Finland
Espoo
Finland
[email protected]
Hans Liljestrand
Aalto University
Espoo
Finland
[email protected]
Andrew Paverd
Aalto University
Espoo
Finland
[email protected]
N.Asokan
Aalto University
Espoo
Finland
[email protected]
E. Reshetova et al.
Submission 44
Submission 44
CCSXML
10002978.10003006.10003007
Security and privacy Operating systems security
500
CCSXML
[500]Security and privacy Operating systems security
Linux kernel, memory safety
## Abstract
The security of billions of devices worldwide depends on the security and robustness of the mainline Linux kernel.
However, the increasing number of kernel-specific vulnerabilities, especiall
http://bugzilla.novell.com/show_bug.cgi?id=875690http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00http://linux.oracle.com/errata/ELSA-2014-0771.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.htmlhttp://pastebin.com/raw.php?i=yTSFUBgZhttp://rhn.redhat.com/errata/RHSA-2014-0512.htmlhttp://secunia.com/advisories/59218http://secunia.com/advisories/59262http://secunia.com/advisories/59599http://source.android.com/security/bulletin/2016-07-01.htmlhttp://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.htmlhttp://www.debian.org/security/2014/dsa-2926http://www.debian.org/security/2014/dsa-2928http://www.exploit-db.com/exploits/33516http://www.openwall.com/lists/oss-security/2014/05/05/6http://www.osvdb.org/106646http://www.ubuntu.com/usn/USN-2196-1http://www.ubuntu.com/usn/USN-2197-1http://www.ubuntu.com/usn/USN-2198-1http://www.ubuntu.com/usn/USN-2199-1http://www.ubuntu.com/usn/USN-2200-1http://www.ubuntu.com/usn/USN-2201-1http://www.ubuntu.com/usn/USN-2202-1http://www.ubuntu.com/usn/USN-2203-1http://www.ubuntu.com/usn/USN-2204-1https://bugzilla.redhat.com/show_bug.cgi?id=1094232https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00http://bugzilla.novell.com/show_bug.cgi?id=875690http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00http://linux.oracle.com/errata/ELSA-2014-0771.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-05/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-05/msg00012.htmlhttp://pastebin.com/raw.php?i=yTSFUBgZhttp://rhn.redhat.com/errata/RHSA-2014-0512.htmlhttp://secunia.com/advisories/59218http://secunia.com/advisories/59262http://secunia.com/advisories/59599http://source.android.com/security/bulletin/2016-07-01.htmlhttp://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.htmlhttp://www.debian.org/security/2014/dsa-2926http://www.debian.org/security/2014/dsa-2928http://www.exploit-db.com/exploits/33516http://www.openwall.com/lists/oss-security/2014/05/05/6http://www.osvdb.org/106646http://www.ubuntu.com/usn/USN-2196-1http://www.ubuntu.com/usn/USN-2197-1http://www.ubuntu.com/usn/USN-2198-1http://www.ubuntu.com/usn/USN-2199-1http://www.ubuntu.com/usn/USN-2200-1http://www.ubuntu.com/usn/USN-2201-1http://www.ubuntu.com/usn/USN-2202-1http://www.ubuntu.com/usn/USN-2203-1http://www.ubuntu.com/usn/USN-2204-1https://bugzilla.redhat.com/show_bug.cgi?id=1094232https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-0196
2014-05-07
Published
2023-05-12
Added to CISA KEV
Exploited in the wild