CVE-2014-8121
published 2015-03-27CVE-2014-8121: DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is…
PriorityP427medium5CVSS 2.0
AVNACLAuNCNINAP
EPSS
5.61%
92.1th percentile
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
Affected
13 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| canonical | ubuntu_linux | — | — |
| debian | glibc | < glibc 2.21-1 (bookworm) | glibc 2.21-1 (bookworm) |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.8 | 2.19-0ubuntu6.8 |
| eglibc | eglibc | >= 0 < 2.19-0ubuntu6.9 | 2.19-0ubuntu6.9 |
| gnu | glibc | <= 2.21 | — |
| gnu | glibc | >= 0 < 2.21-1 | 2.21-1 |
| gnu | glibc | >= 0 < 2.21-1 | 2.21-1 |
| gnu | glibc | >= 0 < 2.21-1 | 2.21-1 |
| gnu | glibc | >= 0 < 2.21-1 | 2.21-1 |
| suse | suse_linux_enterprise_desktop | — | — |
| suse | suse_linux_enterprise_server | — | — |
CVSS provenance
nvdv2.05.0MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
osv5.0MEDIUM
vendor_debian5.0LOW
vendor_redhat5.0MEDIUM
vendor_ubuntu2.6LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hw66-pxhg-8fx8: DB_LOOKUP in nss_files/files-XXX
ghsa_unreviewed·2022-05-14
CVE-2014-8121 [MEDIUM] GHSA-hw66-pxhg-8fx8: DB_LOOKUP in nss_files/files-XXX
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
OSV
eglibc, glibc regression
osv·2016-05-26·CVSS 2.6
CVE-2014-9761 [LOW] eglibc, glibc regression
eglibc, glibc regression
USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for
CVE-2014-9761 introduced a regression which affected applications that
use the libm library but were not fully restarted after the upgrade.
This update removes the fix for CVE-2014-9761 and a future update
will be provided to address this issue.
We apologize for the inconvenience.
Original advisory details:
Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use this
to gain administrative privileges or expose sensitive information.
(CVE-2013-2207, CVE-2016-2856)
Robin Hack discovered that the Name Service Switch (NSS) implementation in
the GNU C Library did not properly manage its file descriptors. An attacker
OSV
eglibc, glibc vulnerabilities
osv·2016-05-25·CVSS 2.6
CVE-2013-2207 [LOW] eglibc, glibc vulnerabilities
eglibc, glibc vulnerabilities
Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use this
to gain administrative privileges or expose sensitive information.
(CVE-2013-2207, CVE-2016-2856)
Robin Hack discovered that the Name Service Switch (NSS) implementation in
the GNU C Library did not properly manage its file descriptors. An attacker
could use this to cause a denial of service (infinite loop).
(CVE-2014-8121)
Joseph Myers discovered that the GNU C Library did not properly handle long
arguments to functions returning a representation of Not a Number (NaN). An
attacker could use this to cause a denial of service (stack exhaustion
leading to an application crash) or possibly execute arbitrary code.
(CVE
OSV
CVE-2014-8121: DB_LOOKUP in nss_files/files-XXX
osv·2015-03-27·CVSS 5.0
CVE-2014-8121 [MEDIUM] CVE-2014-8121: DB_LOOKUP in nss_files/files-XXX
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
Ubuntu
GNU C Library regression
vendor_ubuntu·2016-05-26·CVSS 2.6
CVE-2014-9761 [LOW] GNU C Library regression
Title: GNU C Library regression
Summary: USN-2985-1 introduced a regression in the GNU C Library.
USN-2985-1 fixed vulnerabilities in the GNU C Library. The fix for
CVE-2014-9761 introduced a regression which affected applications that
use the libm library but were not fully restarted after the upgrade.
This update removes the fix for CVE-2014-9761 and a future update
will be provided to address this issue.
We apologize for the inconvenience.
Original advisory details:
Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use this
to gain administrative privileges or expose sensitive information.
(CVE-2013-2207, CVE-2016-2856)
Robin Hack discovered that the Name Service Switch (NSS) implementation in
th
Ubuntu
GNU C Library vulnerabilities
vendor_ubuntu·2016-05-25·CVSS 2.6
CVE-2013-2207 [LOW] GNU C Library vulnerabilities
Title: GNU C Library vulnerabilities
Summary: Several security issues were fixed in the GNU C Library.
Martin Carpenter discovered that pt_chown in the GNU C Library did not
properly check permissions for tty files. A local attacker could use this
to gain administrative privileges or expose sensitive information.
(CVE-2013-2207, CVE-2016-2856)
Robin Hack discovered that the Name Service Switch (NSS) implementation in
the GNU C Library did not properly manage its file descriptors. An attacker
could use this to cause a denial of service (infinite loop).
(CVE-2014-8121)
Joseph Myers discovered that the GNU C Library did not properly handle long
arguments to functions returning a representation of Not a Number (NaN). An
attacker could use this to cause a denial of service (stack exhaustion
Red Hat
glibc: Unexpected closing of nss_files databases after lookups causes denial of service
vendor_redhat·2015-02-23·CVSS 5.0
CVE-2014-8121 [MEDIUM] CWE-835 glibc: Unexpected closing of nss_files databases after lookups causes denial of service
glibc: Unexpected closing of nss_files databases after lookups causes denial of service
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
It was found that the files back end of Name Service Switch (NSS) did not isolate iteration over an entire database from key-based look-up API calls. An application performing look-ups on a database while iterating over it could enter an infinite loop, leading to a denial of service.
Statement: This issue affects the versions of glibc as shipped with Red Hat
Debian
CVE-2014-8121: glibc - DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Lib...
vendor_debian·2014·CVSS 5.0
CVE-2014-8121 [MEDIUM] CVE-2014-8121: glibc - DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Lib...
DB_LOOKUP in nss_files/files-XXX.c in the Name Service Switch (NSS) in GNU C Library (aka glibc or libc6) 2.21 and earlier does not properly check if a file is open, which allows remote attackers to cause a denial of service (infinite loop) by performing a look-up on a database while iterating over it, which triggers the file pointer to be reset.
Scope: local
bookworm: resolved (fixed in 2.21-1)
bullseye: resolved (fixed in 2.21-1)
forky: resolved (fixed in 2.21-1)
sid: resolved (fixed in 2.21-1)
trixie: resolved (fixed in 2.21-1)
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service [fedora-all]
bugzilla·2015-02-23·CVSS 5.0
CVE-2014-8121 [MEDIUM] CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service [fedora-all]
CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue af
Bugzilla
CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service
bugzilla·2014-11-18·CVSS 5.0
CVE-2014-8121 [MEDIUM] CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service
CVE-2014-8121 glibc: Unexpected closing of nss_files databases after lookups causes denial of service
IssueDescription:
The "files" backend for the Name Service Switch (NSS) in glibc does not properly isolate iteration over the entire database from key-based lookups. As a result, an application which performs lookups on a database while iterating over it could enter an infinite loop, leading to a denial of service.
Acknowledgements:
This issue was discovered by Robin Hack of Red Hat.
Discussion:
Analysis:
Running the test case under strace shows that /etc/passwd is continuously opened and closed:
…
open("/etc/passwd", O_RDONLY|O_CLOEXEC) = 3
lseek(3, 0, SEEK_CUR) = 0
read(3, "root:x:0:0:root:/root:/bin/bash\n"..., 4096) = 2717
lseek(3, 2717, SEEK_SET) = 2717
close(3) = 0
open("/etc
http://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0327.htmlhttp://www.debian.org/security/2016/dsa-3480http://www.securityfocus.com/bid/73038http://www.ubuntu.com/usn/USN-2985-1http://www.ubuntu.com/usn/USN-2985-2https://bugzilla.redhat.com/show_bug.cgi?id=1165192https://security.gentoo.org/glsa/201602-02https://sourceware.org/ml/libc-alpha/2015-02/msg00617.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-08/msg00019.htmlhttp://lists.opensuse.org/opensuse-security-announce/2016-02/msg00036.htmlhttp://rhn.redhat.com/errata/RHSA-2015-0327.htmlhttp://www.debian.org/security/2016/dsa-3480http://www.securityfocus.com/bid/73038http://www.ubuntu.com/usn/USN-2985-1http://www.ubuntu.com/usn/USN-2985-2https://bugzilla.redhat.com/show_bug.cgi?id=1165192https://security.gentoo.org/glsa/201602-02https://sourceware.org/ml/libc-alpha/2015-02/msg00617.html
2015-03-27
Published