CVE-2014-4943
published 2014-07-19CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences…
PriorityP335medium6.9CVSS 2.0
AVLACMAuNCCICAC
EXPLOIT
EPSS
2.10%
79.8th percentile
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
Affected
17 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 3.14.13-1 (bookworm) | linux 3.14.13-1 (bookworm) |
| linux | linux_kernel | >= 0 < 3.14.13-1 | 3.14.13-1 |
| linux | linux_kernel | >= 0 < 3.14.13-1 | 3.14.13-1 |
| linux | linux_kernel | >= 0 < 3.14.13-1 | 3.14.13-1 |
| linux | linux_kernel | >= 0 < 3.14.13-1 | 3.14.13-1 |
| linux | linux_kernel | >= 0 < 3.13.0-32.57 | 3.13.0-32.57 |
| linux | linux_kernel | >= 2.6.23 < 3.2.62 | 3.2.62 |
| linux | linux_kernel | >= 3.11 < 3.12.27 | 3.12.27 |
| linux | linux_kernel | >= 3.13 < 3.14.16 | 3.14.16 |
| linux | linux_kernel | >= 3.15 < 3.15.9 | 3.15.9 |
| linux | linux_kernel | >= 3.3 < 3.4.102 | 3.4.102 |
| linux | linux_kernel | >= 3.5 < 3.10.52 | 3.10.52 |
| opensuse | opensuse | — | — |
| redhat | enterprise_linux_server_aus | — | — |
| suse | linux_enterprise_desktop | — | — |
| suse | linux_enterprise_server | — | — |
CVSS provenance
nvdv2.06.9MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
osv6.9MEDIUM
vendor_debian6.9MEDIUM
vendor_redhat6.9MEDIUM
vendor_ubuntu3.3LOW
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Quantal HWE) vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel (Quantal HWE) vulnerabilities
Title: Linux kernel (Quantal HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
Salva Peiró discovered an information leak in the Linux kernel's media-
device driver. A local attacker could exploit this flaw to obtain sensitive
information from kernel memory. (CVE-2014-1739)
An flaw
Ubuntu
Linux kernel (Raring HWE) vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel (Raring HWE) vulnerabilities
Title: Linux kernel (Raring HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
Salva Peiró discovered an information leak in the Linux kernel's media-
device driver. A local attacker could exploit this flaw to obtain sensitive
information from kernel memory. (CVE-2014-1739)
A bounds
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
An flaw was discovered in the Linux kernel's audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denia
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.1
CVE-2014-1739 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Salva Peiró discovered an information leak in the Linux kernel's media-
device driver. A local attacker could exploit this flaw to obtain sensitive
information from kernel memory. (CVE-2014-1739)
A bounds check error was discovered in the socket filter subsystem of the
Linux kernel. A local user could exploit this flaw to cause a denial of
service (system crash) via crafted BPF instructions. (CVE-2014-3144)
A remainder calculation error was discovered in the socket filter
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.1
CVE-2014-1739 [LOW] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Salva Peiró discovered an information leak in the Linux kernel's media-
device driver. A local attacker could exploit this flaw to obtain sensitive
information from kernel memory. (CVE-2014-1739)
A bounds check error was discovered in the socket filter subsystem of the
Linux kernel. A local user could exploit this flaw to cause a denial of
service (system crash) via crafted BPF instructions. (CVE-2014-3144)
A remainder calculation error was discovered in the
Ubuntu
Linux kernel (Saucy HWE) vulnerabilities
vendor_ubuntu·2014-07-17·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel (Saucy HWE) vulnerabilities
Title: Linux kernel (Saucy HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
An flaw was discovered in the Linux kernel's audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or c
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-07-16·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel memory. (CVE-2014-0131)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, whic
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-07-16·CVSS 3.3
CVE-2014-3917 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
An flaw was discovered in the Linux kernel's audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denial of service (OOPS). (CVE-2014-3917)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number, which
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2014-07-16·CVSS 2.9
CVE-2014-0131 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on
x86_64 processors. An attacker could exploit this flaw to cause a denial of
service (System Crash) or potential gain administrative privileges.
(CVE-2014-4699)
Michael S. Tsirkin discovered an information leak in the Linux kernel's
segmentation of skbs when using the zerocopy feature of vhost-net. A local
attacker could exploit this flaw to gain potentially sensitive information
from kernel
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2014-07-16·CVSS 3.3
CVE-2014-3917 [LOW] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
An flaw was discovered in the Linux kernel's audit subsystem when auditing
certain syscalls. A local attacker could exploit this flaw to obtain
potentially sensitive single-bit values from kernel memory or cause a
denial of service (OOPS). (CVE-2014-3917)
Instructions: After a standard system update you need to reboot your computer to make
all the necessary changes.
ATTENTION: Due to an unavoidable ABI change the kernel updates have
been given a new version number,
Red Hat
kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
vendor_redhat·2014-07-16·CVSS 6.9
CVE-2014-4943 [MEDIUM] kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
A flaw was found in the way the pppol2tp_setsockopt() and pppol2tp_getsockopt() functions in the Linux kernel's PPP over L2TP implementation handled requests with a non-SOL_PPPOL2TP socket option level. A local, unprivileged user could use this flaw to escalate their privileges on the system.
Statement: This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.
Please note that on Red Hat Enterprise Linux 6 pppol2tp module is not
automatically loaded when AF
Debian
CVE-2014-4943: linux - The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 a...
vendor_debian·2014·CVSS 6.9
CVE-2014-4943 [MEDIUM] CVE-2014-4943: linux - The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 a...
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
Scope: local
bookworm: resolved (fixed in 3.14.13-1)
bullseye: resolved (fixed in 3.14.13-1)
forky: resolved (fixed in 3.14.13-1)
sid: resolved (fixed in 3.14.13-1)
trixie: resolved (fixed in 3.14.13-1)
GHSA
GHSA-8xp6-4x45-vm77: The PPPoL2TP feature in net/l2tp/l2tp_ppp
ghsa_unreviewed·2022-05-13
CVE-2014-4943 [MEDIUM] CWE-269 GHSA-8xp6-4x45-vm77: The PPPoL2TP feature in net/l2tp/l2tp_ppp
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
OSV
CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp
osv·2014-07-19·CVSS 6.9
CVE-2014-4943 [MEDIUM] CVE-2014-4943: The PPPoL2TP feature in net/l2tp/l2tp_ppp
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
OSV
linux vulnerabilities
osv·2014-07-17·CVSS 2.1
CVE-2014-4943 [LOW] linux vulnerabilities
linux vulnerabilities
Sasha Levin reported a flaw in the Linux kernel's point-to-point protocol
(PPP) when used with the Layer Two Tunneling Protocol (L2TP). A local user
could exploit this flaw to gain administrative privileges. (CVE-2014-4943)
Salva Peiró discovered an information leak in the Linux kernel's media-
device driver. A local attacker could exploit this flaw to obtain sensitive
information from kernel memory. (CVE-2014-1739)
A bounds check error was discovered in the socket filter subsystem of the
Linux kernel. A local user could exploit this flaw to cause a denial of
service (system crash) via crafted BPF instructions. (CVE-2014-3144)
A remainder calculation error was discovered in the socket filter subsystem
of the Linux kernel. A local user could exploit this flaw to ca
No detection rules found.
Bugzilla
CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt() [fedora-all]
bugzilla·2014-07-17·CVSS 6.9
CVE-2014-4943 [MEDIUM] CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt() [fedora-all]
CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt() [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When creating a Bodhi update request, use the bodhi submission link noted
in the next comment(s). This will include the bug IDs of this tracking
bug as well as the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
Bodhi notes field when available.
NOTE: this issue a
Bugzilla
CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
bugzilla·2014-07-14·CVSS 6.9
CVE-2014-4943 [MEDIUM] CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
CVE-2014-4943 kernel: net: pppol2tp: level handling in pppol2tp_[s,g]etsockopt()
A flaw was found in the way pppol2tp_setsockopt() and pppol2tp_getsockopt()
functions in the Linux kernel's PPP over L2TP implementation handled
non-SOL_PPPOL2TP level.
A local, unprivileged user could use this flaw to escalate their privileges on
the system.
Acknowledgements:
Red Hat would like to thank Sasha Levin for reporting this issue.
Discussion:
Statement:
This issue does not affect the Linux kernel packages as shipped with Red Hat
Enterprise Linux 5 and Red Hat Enterprise MRG 2.
Please note that on Red Hat Enterprise Linux 6 pppol2tp module is not
automatically loaded when AF_PPPOX/PX_PROTO_OL2TP socket is created as
Red Hat Enterprise Linux 6 lacks upstream commit 9395a09d05a23bb and default
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3dafhttp://linux.oracle.com/errata/ELSA-2014-0924.htmlhttp://linux.oracle.com/errata/ELSA-2014-3047.htmlhttp://linux.oracle.com/errata/ELSA-2014-3048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://openwall.com/lists/oss-security/2014/07/17/1http://osvdb.org/show/osvdb/109277http://rhn.redhat.com/errata/RHSA-2014-1025.htmlhttp://secunia.com/advisories/59790http://secunia.com/advisories/60011http://secunia.com/advisories/60071http://secunia.com/advisories/60220http://secunia.com/advisories/60380http://secunia.com/advisories/60393http://www.debian.org/security/2014/dsa-2992http://www.exploit-db.com/exploits/36267http://www.securitytracker.com/id/1030610https://bugzilla.redhat.com/show_bug.cgi?id=1119458https://exchange.xforce.ibmcloud.com/vulnerabilities/94665https://github.com/torvalds/linux/commit/3cf521f7dc87c031617fd47e4b7aa2593c2f3dafhttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3dafhttp://linux.oracle.com/errata/ELSA-2014-0924.htmlhttp://linux.oracle.com/errata/ELSA-2014-3047.htmlhttp://linux.oracle.com/errata/ELSA-2014-3048.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlhttp://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://openwall.com/lists/oss-security/2014/07/17/1http://osvdb.org/show/osvdb/109277http://rhn.redhat.com/errata/RHSA-2014-1025.htmlhttp://secunia.com/advisories/59790http://secunia.com/advisories/60011http://secunia.com/advisories/60071http://secunia.com/advisories/60220http://secunia.com/advisories/60380http://secunia.com/advisories/60393http://www.debian.org/security/2014/dsa-2992http://www.exploit-db.com/exploits/36267http://www.securitytracker.com/id/1030610https://bugzilla.redhat.com/show_bug.cgi?id=1119458https://exchange.xforce.ibmcloud.com/vulnerabilities/94665https://github.com/torvalds/linux/commit/3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
2014-07-19
Published