CVE-2014-8133
published 2014-12-17CVE-2014-8133: arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection…
PriorityP48low2.1CVSS 2.0
AVLACLAuNCNIPAN
EPSS
0.58%
45.0th percentile
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
Affected
361 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | linux | < linux 3.16.7-ckt4-1 (bookworm) | linux 3.16.7-ckt4-1 (bookworm) |
| linux | linux_kernel | <= 3.18.1 | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv2.02.1LOWAV:L/AC:L/Au:N/C:N/I:P/A:N
osv2.1LOW
vendor_ubuntu5.5MEDIUM
vendor_debian2.1LOW
vendor_redhat2.1LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities regression
vendor_ubuntu·2015-03-04·CVSS 2.1
[LOW] Linux kernel (Trusty HWE) vulnerabilities regression
Title: Linux kernel (Trusty HWE) vulnerabilities regression
Summary: USN-2515-1 introduced a regression in the Linux kernel.
USN-2515-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementat
Ubuntu
Linux kernel vulnerabilities regression
vendor_ubuntu·2015-03-04·CVSS 2.1
[LOW] Linux kernel vulnerabilities regression
Title: Linux kernel vulnerabilities regression
Summary: USN-2516-1 introduced a regression in the Linux kernel.
USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in
USN-2516-2 was incomplete. There was an unrelated regression in the use of
the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
L
Ubuntu
Linux kernel vulnerability regression
vendor_ubuntu·2015-02-28·CVSS 2.1
[LOW] Linux kernel vulnerability regression
Title: Linux kernel vulnerability regression
Summary: USN-2516-1 introduced a regression in the Linux kernel.
USN-2516-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing us
Ubuntu
Linux kernel (Trusty HWE) vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel (Trusty HWE) vulnerabilities
Title: Linux kernel (Trusty HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A res
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A res
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities
vendor_ubuntu·2015-02-26·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel (Utopic HWE) vulnerabilities
Title: Linux kernel (Utopic HWE) vulnerabilities
Summary: Several security issues were fixed in the kernel.
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-04·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A flaw was discovered with file renaming in the linux kernel. A local user
could exploit this flaw to cause a denial of service (deadlock and system
hang). (CVE-2014-8559)
Prasad J Pandit reported a flaw in the rock_continue function of the Linux
kernel's ISO 9660 CDROM file system. A local user could exploit this fl
Ubuntu
Linux kernel vulnerabilities
vendor_ubuntu·2015-02-04·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel vulnerabilities
Title: Linux kernel vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
Prasad J Pandit reported a flaw in the rock_continue function of the Linux
kernel's ISO 9660 CDROM file system. A local user could exploit this flaw
to cause a denial of service (system crash or hang). (CVE-2014-9420)
Instructions: After a standard system update you need to reboot your computer to make
all the necess
Ubuntu
Linux kernel (OMAP4) vulnerabilities
vendor_ubuntu·2015-02-04·CVSS 2.1
CVE-2014-8133 [LOW] Linux kernel (OMAP4) vulnerabilities
Title: Linux kernel (OMAP4) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A flaw was discovered with file renaming in the linux kernel. A local user
could exploit this flaw to cause a denial of service (deadlock and system
hang). (CVE-2014-8559)
Prasad J Pandit reported a flaw in the rock_continue function of the Linux
kernel's ISO 9660 CDROM file system. A local user could exploit
Ubuntu
Linux kernel (EC2) vulnerabilities
vendor_ubuntu·2015-02-04·CVSS 5.5
CVE-2014-3610 [MEDIUM] Linux kernel (EC2) vulnerabilities
Title: Linux kernel (EC2) vulnerabilities
Summary: Several security issues were fixed in the kernel.
Andy Lutomirski discovered that the Linux kernel does not properly handle
faults associated with the Stack Segment (SS) register in the x86
architecture. A local attacker could exploit this flaw to gain
administrative privileges. (CVE-2014-9322)
Lars Bull reported a race condition in the PIT (programmable interrupt
timer) emulation in the KVM (Kernel Virtual Machine) subsystem of the Linux
kernel. A local guest user with access to PIT i/o ports could exploit this
flaw to cause a denial of service (crash) on the host. (CVE-2014-3611)
Lars Bull and Nadav Amit reported a flaw in how KVM (the Kernel Virtual
Machine) handles noncanonical writes to certain MSR registers. A privileged
guest us
Red Hat
kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
vendor_redhat·2014-12-15·CVSS 2.1
CVE-2014-8133 [LOW] kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
It was found that the espfix functionality could be bypassed by installing a 16-bit RW data segment into GDT instead of LDT (which espfix checks), and using that segment on the stack. A local, unprivileged user could potentially use this flaw to leak kernel stack addresses.
Statement: This issue did not affect the Linux kernel packages as shipped with Red
Hat Enterprise
Debian
CVE-2014-8133: linux - arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Li...
vendor_debian·2014·CVSS 2.1
CVE-2014-8133 [LOW] CVE-2014-8133: linux - arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Li...
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
Scope: local
bookworm: resolved (fixed in 3.16.7-ckt4-1)
bullseye: resolved (fixed in 3.16.7-ckt4-1)
forky: resolved (fixed in 3.16.7-ckt4-1)
sid: resolved (fixed in 3.16.7-ckt4-1)
trixie: resolved (fixed in 3.16.7-ckt4-1)
GHSA
GHSA-6w8j-qr7f-r492: arch/x86/kernel/tls
ghsa_unreviewed·2022-05-17
CVE-2014-8133 [LOW] GHSA-6w8j-qr7f-r492: arch/x86/kernel/tls
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
OSV
linux vulnerabilities
osv·2015-03-04·CVSS 2.1
[LOW] linux vulnerabilities
linux vulnerabilities
USN-2516-1 fixed vulnerabilities in the Linux kernel, and the fix in
USN-2516-2 was incomplete. There was an unrelated regression in the use of
the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information
OSV
linux vulnerability
osv·2015-02-28·CVSS 2.1
[LOW] linux vulnerability
linux vulnerability
USN-2516-1 fixed vulnerabilities in the Linux kernel. There was an unrelated
regression in the use of the virtual counter (CNTVCT) on arm64 architectures.
This update fixes the problem.
We apologize for the inconvenience.
Original advisory details:
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Spa
OSV
linux vulnerabilities
osv·2015-02-26·CVSS 2.1
CVE-2015-0239 [LOW] linux vulnerabilities
linux vulnerabilities
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A restriction bypass was discovered in iptables when conntrack rules are
specif
OSV
linux-lts-utopic vulnerabilities
osv·2015-02-26·CVSS 2.1
CVE-2015-0239 [LOW] linux-lts-utopic vulnerabilities
linux-lts-utopic vulnerabilities
A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of
the SYSTENTER instruction when the guest OS does not initialize the
SYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of
service of the guest OS (crash) or potentially gain privileges on the guest
OS. (CVE-2015-0239)
Andy Lutomirski discovered an information leak in the Linux kernel's Thread
Local Storage (TLS) implementation allowing users to bypass the espfix to
obtain information that could be used to bypass the Address Space Layout
Randomization (ASLR) protection mechanism. A local user could exploit this
flaw to obtain potentially sensitive information from kernel memory.
(CVE-2014-8133)
A restriction bypass was discovered in iptables when conntrack rules
OSV
CVE-2014-8133: arch/x86/kernel/tls
osv·2014-12-17·CVSS 2.1
CVE-2014-8133 [LOW] CVE-2014-8133: arch/x86/kernel/tls
arch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in the Linux kernel through 3.18.1 allows local users to bypass the espfix protection mechanism, and consequently makes it easier for local users to bypass the ASLR protection mechanism, via a crafted application that makes a set_thread_area system call and later reads a 16-bit value.
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS [fedora-all]
bugzilla·2014-12-15·CVSS 2.1
CVE-2014-8133 [LOW] CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS [fedora-all]
CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS [fedora-all]
This is an automatically created tracking bug! It was created to ensure
that one or more security vulnerabilities are fixed in affected versions
of Fedora.
For comments that are specific to the vulnerability please use bugs filed
against the "Security Response" product referenced in the "Blocks" field.
For more information see:
http://fedoraproject.org/wiki/Security/TrackingBugs
When submitting as an update, use the fedpkg template provided in the next
comment(s). This will include the bug IDs of this tracking bug as well as
the relevant top-level CVE bugs.
Please also mention the CVE IDs being fixed in the RPM changelog and the
fedpkg commit message.
NOTE: this issue affects multiple suppo
Bugzilla
CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
bugzilla·2014-12-10·CVSS 2.1
CVE-2014-8133 [LOW] CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
CVE-2014-8133 kernel: x86: espfix(64) bypass via set_thread_area and CLONE_SETTLS
It was found that espfix funcionality (when returning to userspace with a 16
bit stack, the CPU will not restore the high word(s) of stack pointer for us
on executing iret and thus potentially leaks kernel addresses; espfix fixes
this) can be bypassed by installing 16-bit RW data segment into GDT instead
of LDT (which espfix checks for) and using it for stack.
A local unprivileged user could potentially use this flaw to leak kernel
stack addresses.
Acknowledgements:
Red Hat would like to thank Andy Lutomirski for reporting this issue.
Discussion:
Statement:
This issue did not affect the Linux kernel packages as shipped with Red
Hat Enterprise Linux 7 and Red Hat Enterprise Linux MRG 2.
Red Hat Enterpr
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=41bdc78544b8a93a9c6814b8bbbfef966272abbehttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1272.htmlhttp://secunia.com/advisories/62801http://www.debian.org/security/2015/dsa-3128http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/12/15/6http://www.securityfocus.com/bid/71684http://www.ubuntu.com/usn/USN-2490-1http://www.ubuntu.com/usn/USN-2491-1http://www.ubuntu.com/usn/USN-2492-1http://www.ubuntu.com/usn/USN-2493-1http://www.ubuntu.com/usn/USN-2515-1http://www.ubuntu.com/usn/USN-2516-1http://www.ubuntu.com/usn/USN-2517-1http://www.ubuntu.com/usn/USN-2518-1https://bugzilla.redhat.com/show_bug.cgi?id=1172797https://github.com/torvalds/linux/commit/41bdc78544b8a93a9c6814b8bbbfef966272abbehttp://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=41bdc78544b8a93a9c6814b8bbbfef966272abbehttp://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlhttp://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlhttp://rhn.redhat.com/errata/RHSA-2015-1272.htmlhttp://secunia.com/advisories/62801http://www.debian.org/security/2015/dsa-3128http://www.mandriva.com/security/advisories?name=MDVSA-2015:058http://www.openwall.com/lists/oss-security/2014/12/15/6http://www.securityfocus.com/bid/71684http://www.ubuntu.com/usn/USN-2490-1http://www.ubuntu.com/usn/USN-2491-1http://www.ubuntu.com/usn/USN-2492-1http://www.ubuntu.com/usn/USN-2493-1http://www.ubuntu.com/usn/USN-2515-1http://www.ubuntu.com/usn/USN-2516-1http://www.ubuntu.com/usn/USN-2517-1http://www.ubuntu.com/usn/USN-2518-1https://bugzilla.redhat.com/show_bug.cgi?id=1172797https://github.com/torvalds/linux/commit/41bdc78544b8a93a9c6814b8bbbfef966272abbe
2014-12-17
Published