CVE-2014-7970
published 2014-10-13CVE-2014-7970: The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which…
PriorityP420medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
EPSS
0.67%
48.4th percentile
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
Affected
10 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | linux | < linux 3.16.7-1 (bookworm) | linux 3.16.7-1 (bookworm) |
| linux | linux_kernel | <= 3.17 | — |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.16.7-1 | 3.16.7-1 |
| linux | linux_kernel | >= 0 < 3.13.0-40.69 | 3.13.0-40.69 |
| novell | suse_linux_enterprise_server | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
nvdv2.04.9MEDIUMAV:L/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_ubuntu7.5HIGH
vendor_debian5.5MEDIUM
vendor_redhat5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2013-7421 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
A flaw was discovered in the automatic loading of modules in the crypto
subsystem of the Linux kernel. A local user could exploit this flaw to load
installed kernel modules, increasing the attack surface and potentially
using this to gain administrative privileges. (CVE-2013-7421)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chro
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2013-7421 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
A flaw was discovered in the automatic loading of modules in the crypto
subsystem of the Linux kernel. A local user could exploit this flaw to load
installed kernel modules, increasing the attack surface and potentially
using this to gain administrative privileges. (CVE-2013-7421)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot direc
Ubuntu
Linux kernel regression
vendor_ubuntu·2014-12-19·CVSS 7.5
[HIGH] Linux kernel regression
Title: Linux kernel regression
Summary: USN-2448-1 introduced a regression in the Linux kernel.
USN-2448-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated
regression TCP Throughput drops to zero for several drivers after upgrading.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly handle private
Ubuntu
Linux kernel (Utopic HWE) regression
vendor_ubuntu·2014-12-19·CVSS 7.5
[HIGH] Linux kernel (Utopic HWE) regression
Title: Linux kernel (Utopic HWE) regression
Summary: USN-2447-1 introduced a regression in the Linux kernel.
USN-2447-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated
regression TCP Throughput drops to zero for several drivers after upgrading.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly h
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2014-12-12·CVSS 7.5
CVE-2014-3673 [HIGH] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered that the Linux kernel does not properly handle
faults associated with the Stack Segment (SS) register in the x86
architecture. A local attacker could exploit this flaw to gain
administrative privileges. (CVE-2014-9322)
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly han
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-12-12·CVSS 7.5
CVE-2014-3673 [HIGH] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered that the Linux kernel does not properly handle
faults associated with the Stack Segment (SS) register in the x86
architecture. A local attacker could exploit this flaw to gain
administrative privileges. (CVE-2014-9322)
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly handle private s
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of servi
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of service (mount-tre
Red Hat
Kernel: fs: VFS denial of service
vendor_redhat·2014-10-08·CVSS 5.5
CVE-2014-7970 [MEDIUM] Kernel: fs: VFS denial of service
Kernel: fs: VFS denial of service
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
Statement: This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
Package: kernel (Red Hat Enterprise Linux 5) - Not affected
Package: kernel (Red Hat Enterprise Linux 6) - Not affected
Package: realtime-kernel (Red Hat Enterprise MRG 2) - Not affected
Debian
CVE-2014-7970: linux - The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17...
vendor_debian·2014·CVSS 5.5
CVE-2014-7970 [MEDIUM] CVE-2014-7970: linux - The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17...
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
Scope: local
bookworm: resolved (fixed in 3.16.7-1)
bullseye: resolved (fixed in 3.16.7-1)
forky: resolved (fixed in 3.16.7-1)
sid: resolved (fixed in 3.16.7-1)
trixie: resolved (fixed in 3.16.7-1)
GHSA
GHSA-7p5j-7j45-6mrj: The pivot_root implementation in fs/namespace
ghsa_unreviewed·2022-05-13
CVE-2014-7970 [MEDIUM] CWE-400 GHSA-7p5j-7j45-6mrj: The pivot_root implementation in fs/namespace
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
OSV
linux-lts-utopic regression
osv·2014-12-19·CVSS 7.5
[HIGH] linux-lts-utopic regression
linux-lts-utopic regression
USN-2447-1 fixed vulnerabilities in the Linux kernel. Due to an unrelated
regression TCP Throughput drops to zero for several drivers after upgrading.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly handle private syscall
numbers. A local user could exploit this flaw to cause a den
OSV
linux-lts-utopic vulnerabilities
osv·2014-12-12·CVSS 7.5
CVE-2014-9322 [HIGH] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
Andy Lutomirski discovered that the Linux kernel does not properly handle
faults associated with the Stack Segment (SS) register in the x86
architecture. A local attacker could exploit this flaw to gain
administrative privileges. (CVE-2014-9322)
An information leak in the Linux kernel was discovered that could leak the
high 16 bits of the kernel stack address on 32-bit Kernel Virtual Machine
(KVM) paravirt guests. A user in the guest OS could exploit this leak to
obtain information that could potentially be used to aid in attacking the
kernel. (CVE-2014-8134)
Rabin Vincent, Robert Swiecki, Russell King discovered that the ftrace
subsystem of the Linux kernel does not properly handle private syscall
numbers. A local user could exploit this flaw to cause a
OSV
linux vulnerabilities
osv·2014-11-25·CVSS 5.5
CVE-2014-3690 [MEDIUM] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in how the Linux kernel's KVM (Kernel Virtual
Machine) subsystem handles the CR4 control register at VM entry on Intel
processors. A local host OS user can exploit this to cause a denial of
service (kill arbitrary processes, or system disruption) by leveraging
/dev/kvm access. (CVE-2014-3690)
Don Bailey discovered a flaw in the LZO decompress algorithm used by the
Linux kernel. An attacker could exploit this flaw to cause a denial of
service (memory corruption or OOPS). (CVE-2014-4608)
Andy Lutomirski discovered a flaw in how the Linux kernel handles
pivot_root when used with a chroot directory. A local user could exploit
this flaw to cause a denial of service (mount-tree loop). (CVE-2014-7970)
Andy Lutomirski discovered that the Linux kernel
Kernel
Merge branch 'CVE-2014-7970' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux
kernel_security·2014-10-15·CVSS 5.5
CVE-2014-7970 [MEDIUM] Merge branch 'CVE-2014-7970' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux
Merge branch 'CVE-2014-7970' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux
Pull pivot_root() fix from Andy Lutomirski.
Prevent a leak of unreachable mounts.
* 'CVE-2014-7970' of git://git.kernel.org/pub/scm/linux/kernel/git/luto/linux:
mnt: Prevent pivot_root from creating a loop in the mount tree
OSV
CVE-2014-7970: The pivot_root implementation in fs/namespace
osv·2014-10-13·CVSS 5.5
CVE-2014-7970 [MEDIUM] CVE-2014-7970: The pivot_root implementation in fs/namespace
The pivot_root implementation in fs/namespace.c in the Linux kernel through 3.17 does not properly interact with certain locations of a chroot directory, which allows local users to cause a denial of service (mount-tree loop) via . (dot) values in both arguments to the pivot_root system call.
Kernel
mnt: Prevent pivot_root from creating a loop in the mount tree
kernel_security·2014-10-08·CVSS 5.5
CVE-2014-7970 [MEDIUM] mnt: Prevent pivot_root from creating a loop in the mount tree
mnt: Prevent pivot_root from creating a loop in the mount tree
Andy Lutomirski recently demonstrated that when chroot is used to set
the root path below the path for the new ``root'' passed to pivot_root
the pivot_root system call succeeds and leaks mounts.
In examining the code I see that starting with a new root that is
below the current root in the mount tree will result in a loop in the
mount tree after the mounts are detached and then reattached to one
another. Resulting in all kinds of ugliness including a leak of that
mounts involved in the leak of the mount loop.
Prevent this problem by ensuring that the new mount is reachable from
the current root of the mount tree.
[Added stable cc. Fixes CVE-2014-7970. --Andy]
Cc: [email protected]
Reported-by: Andy Lutomirski
Reviewed
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-7970 Kernel: fs: VFS denial of service [fedora-all]
bugzilla·2014-10-10·CVSS 5.5
CVE-2014-7970 [MEDIUM] CVE-2014-7970 Kernel: fs: VFS denial of service [fedora-all]
CVE-2014-7970 Kernel: fs: VFS denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple supported versions of Fedora. While onl
Bugzilla
CVE-2014-7970 Kernel: fs: VFS denial of service
bugzilla·2014-10-09·CVSS 5.5
CVE-2014-7970 [MEDIUM] CVE-2014-7970 Kernel: fs: VFS denial of service
CVE-2014-7970 Kernel: fs: VFS denial of service
Linux kernel built with the VFS and user name-space support(CONFIG_USER_NS) is vulnerable to a potential DoS flaw. It could occur while doing pivot_root(2) call to change root file system.
A privileged user/process could use this flaw to potentially render a system unusable leading to DoS.
Upstream fix:
-> http://thread.gmane.org/gmane.linux.file-systems/89076
Reference:
-> http://seclists.org/oss-sec/2014/q4/228
Discussion:
Statement:
This issue does not affect the versions of the kernel package as shipped with
Red Hat Enterprise Linux 5, 6, 7 and Red Hat Enterprise MRG 2.
---
Created kernel tracking bugs for this issue:
Affects: fedora-all [bug 1151484]
---
Upstream commit:
https://git.kernel.org/cgit/linux/kernel/git/torvalds/
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://secunia.com/advisories/60174http://secunia.com/advisories/61142http://www.openwall.com/lists/oss-security/2014/10/08/21http://www.securityfocus.com/bid/70319http://www.securitytracker.com/id/1030991http://www.spinics.net/lists/linux-fsdevel/msg79153.htmlhttp://www.ubuntu.com/usn/USN-2419-1http://www.ubuntu.com/usn/USN-2420-1http://www.ubuntu.com/usn/USN-2513-1http://www.ubuntu.com/usn/USN-2514-1https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://bugzilla.redhat.com/show_bug.cgi?id=1151095https://exchange.xforce.ibmcloud.com/vulnerabilities/96921https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d0826019e529f21c84687521d03f60cd241ca7dhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://secunia.com/advisories/60174http://secunia.com/advisories/61142http://www.openwall.com/lists/oss-security/2014/10/08/21http://www.securityfocus.com/bid/70319http://www.securitytracker.com/id/1030991http://www.spinics.net/lists/linux-fsdevel/msg79153.htmlhttp://www.ubuntu.com/usn/USN-2419-1http://www.ubuntu.com/usn/USN-2420-1http://www.ubuntu.com/usn/USN-2513-1http://www.ubuntu.com/usn/USN-2514-1https://access.redhat.com/errata/RHSA-2017:1842https://access.redhat.com/errata/RHSA-2017:2077https://bugzilla.redhat.com/show_bug.cgi?id=1151095https://exchange.xforce.ibmcloud.com/vulnerabilities/96921https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=0d0826019e529f21c84687521d03f60cd241ca7d
2014-10-13
Published