CVE-2014-4508
published 2014-06-23CVE-2014-4508: arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set…
PriorityP413medium4.7CVSS 2.0
AVLACMAuNCNINAC
EPSS
0.41%
34.0th percentile
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 3.14.9-1 (bookworm) | linux 3.14.9-1 (bookworm) |
| linux | linux_kernel | <= 3.15.1 | — |
| linux | linux_kernel | >= 0 < 3.14.9-1 | 3.14.9-1 |
| linux | linux_kernel | >= 0 < 3.14.9-1 | 3.14.9-1 |
| linux | linux_kernel | >= 0 < 3.14.9-1 | 3.14.9-1 |
| linux | linux_kernel | >= 0 < 3.14.9-1 | 3.14.9-1 |
| linux | linux_kernel | >= 0 < 3.13.0-35.62 | 3.13.0-35.62 |
CVSS provenance
nvdv2.04.7MEDIUMAV:L/AC:M/Au:N/C:N/I:N/A:C
osv5.5MEDIUM
vendor_ubuntu5.5MEDIUM
vendor_debian4.7MEDIUM
vendor_redhat4.7MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-j8j3-qq6w-fxvv: arch/x86/kernel/entry_32
ghsa_unreviewed·2022-05-13
CVE-2014-4508 [MEDIUM] GHSA-j8j3-qq6w-fxvv: arch/x86/kernel/entry_32
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
OSV
linux vulnerabilities
osv·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-2014-0206)
A flaw was discovered in the Linux kernel's implementation of use
Kernel
x86_32, entry: Clean up sysenter_badsys declaration
kernel_security·2014-08-15·CVSS 4.7
CVE-2014-4508 [MEDIUM] x86_32, entry: Clean up sysenter_badsys declaration
x86_32, entry: Clean up sysenter_badsys declaration
commit 554086d85e "x86_32, entry: Do syscall exit work on badsys
(CVE-2014-4508)" introduced a new jump label (sysenter_badsys) but
somehow the END statements seem to have gone wrong (at least it
feels that way to me).
This does not seem to be a fatal problem, but just for the sake
of symmetry, change the second syscall_badsys to sysenter_badsys.
Signed-off-by: Stefan Bader
Link: http://lkml.kernel.org/r/[email protected]
Acked-by: Andy Lutomirski
Signed-off-by: H. Peter Anvin
Kernel
x86_32, entry: Store badsys error code in %eax
kernel_security·2014-07-22·CVSS 4.7
CVE-2014-4508 [MEDIUM] x86_32, entry: Store badsys error code in %eax
x86_32, entry: Store badsys error code in %eax
Commit 554086d ("x86_32, entry: Do syscall exit work on badsys
(CVE-2014-4508)") introduced a regression in the x86_32 syscall entry
code, resulting in syscall() not returning proper errors for undefined
syscalls on CPUs supporting the sysenter feature.
The following code:
> int result = syscall(666);
> printf("result=%d errno=%d error=%s\n", result, errno, strerror(errno));
results in:
> result=666 errno=0 error=Success
Obviously, the syscall return value is the called syscall number, but it
should have been an ENOSYS error. When run under ptrace it behaves
correctly, which makes it hard to debug in the wild:
> result=-1 errno=38 error=Function not implemented
The %eax register is the return value register. For debugging via ptrace
th
Kernel
Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
kernel_security·2014-06-27·CVSS 4.7
CVE-2014-4508 [MEDIUM] Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Merge branch 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip
Pull x86 fixes from Peter Anvin:
"A pile of fixes related to the VDSO, EFI and 32-bit badsys handling.
It turns out that removing the section headers from the VDSO breaks
gdb, so this puts back most of them. A very simple typo broke
rt_sigreturn on some versions of glibc, with obviously disastrous
results. The rest is pretty much fixes for the corresponding fallout.
The EFI fixes fixes an arithmetic overflow on 32-bit systems and
quiets some build warnings.
Finally, when invoking an invalid system call number on x86-32, we
bypass a bunch of handling, which can make the audit code oops"
* 'x86/urgent' of git://git.kernel.org/pub/scm/linux/kernel/git/tip/tip:
efi-pstore: Fix an overflow on 32-bit builds
x
OSV
CVE-2014-4508: arch/x86/kernel/entry_32
osv·2014-06-23·CVSS 4.7
CVE-2014-4508 [MEDIUM] CVE-2014-4508: arch/x86/kernel/entry_32
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
Kernel
x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
kernel_security·2014-06-23·CVSS 4.7
CVE-2014-4508 [MEDIUM] x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
x86_32, entry: Do syscall exit work on badsys (CVE-2014-4508)
The bad syscall nr paths are their own incomprehensible route
through the entry control flow. Rearrange them to work just like
syscalls that return -ENOSYS.
This fixes an OOPS in the audit code when fast-path auditing is
enabled and sysenter gets a bad syscall nr (CVE-2014-4508).
This has probably been broken since Linux 2.6.27:
af0575bba0 i386 syscall audit fast-path
Cc: [email protected]
Cc: Roland McGrath
Reported-by: Toralf Förster
Signed-off-by: Andy Lutomirski
Link: http://lkml.kernel.org/r/e09c499eade6fc321266dd6b54da7beb28d6991c.1403558229.git.luto@amacapital.net
Signed-off-by: H. Peter Anvin
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 3.3
CVE-2014-3917 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
An flaw was discovered in the Linux kernel's audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denial of service (OOPS). (CVE-2014-3917)
An information leak was discovered in the rd_mcp backend of the iSCSI
target subsystem in the Linux kernel. A local user could exploit this flaw
to obtain sensitive information from ramdisk_mcp memory by leveraging
access to a SCSI initiator. (CVE-2014-4027)
Sasha Levin reported an issue with the Linux kernel's shared memory
subsystem when used with range notifications and hole punching. A local
user could exploit this flaw to cause a denial
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel mem
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0203 [MEDIUM] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A bug was discovered in the handling of pathname components when used with
an autofs direct mount. A local user could exploit this flaw to cause a
denial of service (system crash) via an open system call. (CVE-2014-0203)
Toralf Förster reported an error in the Linux kernels syscall auditing on
32 bit x86 platforms. A local user could exploit this flaw to cause a
denial of service (OOPS and system crash). (CVE-2014-4508)
An information leak was discovered in the control implemenation of the
Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A
local user could exploit this flaw to obtain sensitive information from
kernel memory. (CVE-2014-4652)
A use-after-free flaw
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0155 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Linux kernel virtual machine's (kvm)
validation of interrupt requests (irq). A guest OS user could exploit this
flaw to cause a denial of service (host OS crash). (CVE-2014-0155)
Andy Lutomirski discovered a flaw in the authorization of netlink socket
operations when a socket is passed to a process of more privilege. A local
user could exploit this flaw to bypass access restrictions by having a
privileged executable do something it was not intended to do.
(CVE-2014-0181)
An information leak was discovered in the Linux kernels
aio_read_events_ring function. A local user could exploit this flaw to
obtain potentially sensitive information from kernel memory.
(CVE-201
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-09-02·CVSS 5.5
CVE-2014-0203 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A bug was discovered in the handling of pathname components when used with
an autofs direct mount. A local user could exploit this flaw to cause a
denial of service (system crash) via an open system call. (CVE-2014-0203)
Toralf Förster reported an error in the Linux kernels syscall auditing on
32 bit x86 platforms. A local user could exploit this flaw to cause a
denial of service (OOPS and system crash). (CVE-2014-4508)
An information leak was discovered in the control implemenation of the
Advanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A
local user could exploit this flaw to obtain sensitive information from
kernel memory. (CVE-2014-4652)
A use-after-free flaw was di
Red Hat
Kernel: x86_32: BUG in syscall auditing
vendor_redhat·2014-06-16·CVSS 4.7
CVE-2014-4508 [MEDIUM] CWE-391 Kernel: x86_32: BUG in syscall auditing
Kernel: x86_32: BUG in syscall auditing
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
A flaw was found in the Linux kernel’s system-call auditing support(CONFIG_AUDITSYSCALL) for 32-bit platforms. It is vulnerable to a crash caused by erroneous handling of bad system call numerals. This issue occurs during syscall(2) calls if system-call auditing is enabled on the system. This flaw allows an unprivileged user or process to crash the system kernel, resulting in a denial of service. The highest threat from this vulnerability is system availability.
Debian
CVE-2014-4508: linux - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 plat...
vendor_debian·2014·CVSS 4.7
CVE-2014-4508 [MEDIUM] CVE-2014-4508: linux - arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 plat...
arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.
Scope: local
bookworm: resolved (fixed in 3.14.9-1)
bullseye: resolved (fixed in 3.14.9-1)
forky: resolved (fixed in 3.14.9-1)
sid: resolved (fixed in 3.14.9-1)
trixie: resolved (fixed in 3.14.9-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing [fedora-all]
bugzilla·2014-06-23·CVSS 4.7
CVE-2014-4508 [MEDIUM] CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing [fedora-all]
CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue affects multiple supported v
Bugzilla
CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing
bugzilla·2014-06-20·CVSS 4.7
CVE-2014-4508 [MEDIUM] CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing
CVE-2014-4508 Kernel: x86_32: BUG in syscall auditing
Linux kernel built with the system-call auditing support(CONFIG_AUDITSYSCALL)
for 32-bit platforms is vulnerable to a crash caused by erroneous handling of
bad system call numerals. It occurs during syscall(2) calls, if system-call
auditing is enabled on the system.
An unprivileged user/process could use this flaw to crash the system kernel
resulting in DoS.
Upstream fix:
-> https://lkml.org/lkml/2014/6/16/682
Reference:
-> http://www.openwall.com/lists/oss-security/2014/06/20/1
Discussion:
MITRE assigned CVE-2014-4508 to this issue:
http://www.openwall.com/lists/oss-security/2014/06/20/10
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1112073]
---
kernel-3.14.9-200.fc20 has been pushed to the Fedo
http://article.gmane.org/gmane.linux.kernel/1726110http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://openwall.com/lists/oss-security/2014/06/20/1http://secunia.com/advisories/58964http://secunia.com/advisories/60564http://www.openwall.com/lists/oss-security/2014/06/20/10http://www.openwall.com/lists/oss-security/2020/11/12/3http://www.securityfocus.com/bid/68126http://www.ubuntu.com/usn/USN-2334-1https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.61http://article.gmane.org/gmane.linux.kernel/1726110http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://openwall.com/lists/oss-security/2014/06/20/1http://secunia.com/advisories/58964http://secunia.com/advisories/60564http://www.openwall.com/lists/oss-security/2014/06/20/10http://www.openwall.com/lists/oss-security/2020/11/12/3http://www.securityfocus.com/bid/68126http://www.ubuntu.com/usn/USN-2334-1https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.2.61
2014-06-23
Published