CVE-2014-0206
published 2014-06-25CVE-2014-0206: Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from…
PriorityP46low2.1CVSS 2.0
AVLACLAuNCPINAN
EPSS
0.45%
37.3th percentile
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.14.10-1 (bookworm) | linux 3.14.10-1 (bookworm) |
| android | — | — | |
| linux | linux_kernel | <= 3.15.1 | — |
| linux | linux_kernel | >= 0 < 3.14.10-1 | 3.14.10-1 |
| linux | linux_kernel | >= 0 < 3.14.10-1 | 3.14.10-1 |
| linux | linux_kernel | >= 0 < 3.14.10-1 | 3.14.10-1 |
| linux | linux_kernel | >= 0 < 3.14.10-1 | 3.14.10-1 |
| linux | linux_kernel | >= 0 < 3.13.0-35.62 | 3.13.0-35.62 |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:P/I:N/A:N
osv5.5MEDIUM
vendor_ubuntu5.5MEDIUM
vendor_cisco5.0MEDIUM
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-6mj3-jgwh-v3xp: Array index error in the aio_read_events_ring function in fs/aio
ghsa_unreviewed·2022-05-14
CVE-2014-0206 [LOW] GHSA-6mj3-jgwh-v3xp: Array index error in the aio_read_events_ring function in fs/aio
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
OSV
linux vulnerabilities
osv·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-2014-0206)
A flaw was discovered in the Linux kernel's implementation of use
OSV
CVE-2014-0206: Array index error in the aio_read_events_ring function in fs/aio
osv·2014-06-25·CVSS 2.1
CVE-2014-0206 [LOW] CVE-2014-0206: Array index error in the aio_read_events_ring function in fs/aio
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Kernel
aio: fix kernel memory disclosure in io_getevents() introduced in v3.10
kernel_security·2014-06-24·CVSS 2.1
CVE-2014-0206 [LOW] aio: fix kernel memory disclosure in io_getevents() introduced in v3.10
aio: fix kernel memory disclosure in io_getevents() introduced in v3.10
A kernel memory disclosure was introduced in aio_read_events_ring() in v3.10
by commit a31ad380bed817aa25f8830ad23e1a0480fef797. The changes made to
aio_read_events_ring() failed to correctly limit the index into
ctx->ring_pages[], allowing an attacked to cause the subsequent kmap() of
an arbitrary page with a copy_to_user() to copy the contents into userspace.
This vulnerability has been assigned CVE-2014-0206. Thanks to Mateusz and
Petr for disclosing this issue.
This patch applies to v3.12+. A separate backport is needed for 3.10/3.11.
Signed-off-by: Benjamin LaHaise
Cc: Mateusz Guzik
Cc: Petr Matousek
Cc: Kent Overstreet
Cc: Jeff Moyer
Cc: [email protected]
Kernel
aio: fix aio request leak when events are reaped by userspace
kernel_security·2014-06-24·CVSS 2.1
CVE-2014-0206 [LOW] aio: fix aio request leak when events are reaped by userspace
aio: fix aio request leak when events are reaped by userspace
The aio cleanups and optimizations by kmo that were merged into the 3.10
tree added a regression for userspace event reaping. Specifically, the
reference counts are not decremented if the event is reaped in userspace,
leading to the application being unable to submit further aio requests.
This patch applies to 3.12+. A separate backport is required for 3.10/3.11.
This issue was uncovered as part of CVE-2014-0206.
Signed-off-by: Benjamin LaHaise
Cc: [email protected]
Cc: Kent Overstreet
Cc: Mateusz Guzik
Cc: Petr Matousek
Kernel
Merge git://git.kvack.org/~bcrl/aio-fixes
kernel_security·2014-06-24·CVSS 2.1
CVE-2014-0206 [LOW] Merge git://git.kvack.org/~bcrl/aio-fixes
Merge git://git.kvack.org/~bcrl/aio-fixes
Pull aio fixes from Ben LaHaise:
"These fix a kernel memory disclosure issue (arbitrary kmap() &
copy_to_user()) revealed in CVE-2014-0206 by changes that were
introduced in v3.10"
* git://git.kvack.org/~bcrl/aio-fixes:
aio: fix kernel memory disclosure in io_getevents() introduced in v3.10
aio: fix aio request leak when events are reaped by userspace
Android
CVE-2014-0206: Android Security Bulletin 2017-04-01
CVE: CVE-2014-0206
Severity: HIGH
References: A-34465735
Upstream kernel
vendor_android·2017-04-01·CVSS 2.1
CVE-2014-0206 [LOW] CVE-2014-0206: Android Security Bulletin 2017-04-01
CVE: CVE-2014-0206
Severity: HIGH
References: A-34465735
Upstream kernel
Android Security Bulletin 2017-04-01
CVE: CVE-2014-0206
Severity: HIGH
References: A-34465735
Upstream kernel
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco·2015-03-10·CVSS 5.0
CVE-2014-3569 [MEDIUM] CWE-20 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows:
CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability
CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability
CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability
CVE-2014-3572: OpenSSL Elliptic Curve Crypt
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel mem
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-201
Red Hat
kernel: aio: insufficient sanitization of head in aio_read_events_ring()
vendor_redhat·2014-06-24·CVSS 2.1
CVE-2014-0206 [LOW] kernel: aio: insufficient sanitization of head in aio_read_events_ring()
kernel: aio: insufficient sanitization of head in aio_read_events_ring()
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat Enterprise Linux 5 and 6.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Debian
CVE-2014-0206: linux - Array index error in the aio_read_events_ring function in fs/aio.c in the Linux ...
vendor_debian·2014·CVSS 2.1
CVE-2014-0206 [LOW] CVE-2014-0206: linux - Array index error in the aio_read_events_ring function in fs/aio.c in the Linux ...
Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive information from kernel memory via a large head value.
Scope: local
bookworm: resolved (fixed in 3.14.10-1)
bullseye: resolved (fixed in 3.14.10-1)
forky: resolved (fixed in 3.14.10-1)
sid: resolved (fixed in 3.14.10-1)
trixie: resolved (fixed in 3.14.10-1)
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2015-0204 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2015-0204: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2014-3572 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2014-3572: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2014-3571 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2014-3571: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2015-0205 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2015-0205: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2015-0206 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2015-0206: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2014-8275 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2014-8275: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
Cisco
Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
vendor_cisco
CVE-2014-3569 Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
CVE-2014-3569: Multiple Vulnerabilities in OpenSSL (January 2015) Affecting Cisco Products
Multiple Cisco products incorporate a version of the OpenSSL package affected by one or more vulnerabilities that could allow an unauthenticated, remote attacker to cause a denial of service condition or perform a man-in-the-middle attack. On January 8, 2015, the OpenSSL Project released a security advisory detailing eight distinct vulnerabilities. The vulnerabilities are referenced in this document as follows: CVE-2014-3571: OpenSSL DTLS Message Processing Denial of Service Vulnerability CVE-2015-0206: OpenSSL dtls1_buffer_record Function DTLS Message Processing Denial of Service Vulnerability CVE-2014-3569: OpenSSL no-ssl3 Option NULL Pointer Dereference Vulnerability CVE-2014-3572: OpenSSL Ellipti
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring() [fedora-all]
bugzilla·2014-06-25·CVSS 2.1
CVE-2014-0206 [LOW] CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring() [fedora-all]
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this i
Bugzilla
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring()
bugzilla·2014-05-06·CVSS 2.1
CVE-2014-0206 [LOW] CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring()
CVE-2014-0206 kernel: aio: insufficient sanitization of head in aio_read_events_ring()
It was found that aio_read_events_ring() function in the Linux kernel's
AIO subsystem did not properly sanitize AIO ring head coming from
userspace.
An unprivileged local user could use this flaw to randomly disclose parts
of (physical) memory belonging to kernel and/or other processes.
Introduced by:
http://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=a31ad380bed817aa25f8830ad23e1a0480fef797
Upstream commits:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=f8567a3845ac
Acknowledgements:
This issue was discovered by Mateusz Guzik of Red Hat.
Discussion:
Statemen
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=edfbbf388f293d70bf4b7c0bc38774d05e6f711ahttp://secunia.com/advisories/59278http://www.securityfocus.com/bid/68176http://www.securitytracker.com/id/1030479http://www.securitytracker.com/id/1038201https://bugzilla.redhat.com/show_bug.cgi?id=1094602https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29https://github.com/torvalds/linux/commit/edfbbf388f293d70bf4b7c0bc38774d05e6f711ahttps://source.android.com/security/bulletin/2017-04-01https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.46https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.24https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.3http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=edfbbf388f293d70bf4b7c0bc38774d05e6f711ahttp://secunia.com/advisories/59278http://www.securityfocus.com/bid/68176http://www.securitytracker.com/id/1030479http://www.securitytracker.com/id/1038201https://bugzilla.redhat.com/show_bug.cgi?id=1094602https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=edfbbf388f29https://github.com/torvalds/linux/commit/edfbbf388f293d70bf4b7c0bc38774d05e6f711ahttps://source.android.com/security/bulletin/2017-04-01https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.46https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.24https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.3
2014-06-25
Published