Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2014-9322 — Improper Privilege Management in Kernel

CWE-269 — Improper Privilege ManagementCWE-841 — Improper Enforcement of Behavioral Workflow19 documents9 sources
Severity
7.8HIGHNVD
OSV7.5
EPSS
5.2%
top 10.03%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
6
Linux KernelCanonical Ubuntu LinuxGoogle Android+3 more
Timeline
PublishedDec 17
Latest updateMay 13

Description

arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages6 packages

▶NVDlinux/linux_kernel3.3 — 3.4.106+6
▶Debianlinux/linux_kernel< 3.16.7-ckt2-1+3
▶Ubuntulinux/linux_kernel< 3.13.0-43.72
▶NVDgoogle/android6.0, 6.0.1+1

Also affects: Ubuntu Linux 10.04, Enterprise Linux 5.6

Patches

Patch: source.android.com ↗Patch: www.openwall.com ↗Patch: bugzilla.redhat.com ↗

🔴Vulnerability Details

5
GHSA
GHSA-h8qx-jqqh-5mjc: arch/x86/kernel/entry_64↗2022-05-13
▶
OSV
CVE-2014-9322: arch/x86/kernel/entry_64↗2014-12-17
▶
CVEList
CVE-2014-9322: arch/x86/kernel/entry_64↗2014-12-17
▶
OSV
linux vulnerabilities↗2014-12-12
▶
OSV
linux-lts-utopic vulnerabilities↗2014-12-12
▶

💥Exploits & PoCs

2
Exploit-DB
Linux Kernel - 'BadIRET' Local Privilege Escalation↗2017-07-24
▶
Exploit-DB
Linux Kernel 3.17.5 - IRET Instruction #SS Fault Handling Crash (PoC)↗2015-03-04
▶

📋Vendor Advisories

10
Ubuntu
Linux kernel (EC2) vulnerabilities↗2015-02-04
▶
Ubuntu
Linux kernel (OMAP4) vulnerabilities↗2015-01-13
▶
Ubuntu
Linux kernel vulnerabilities↗2015-01-13
▶
Red Hat
kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility↗2014-12-15
▶
Ubuntu
Linux kernel (Utopic HWE) vulnerabilities↗2014-12-12
▶

💬Community

1
Bugzilla
CVE-2014-9322 kernel: x86: local privesc due to bad_iret and paranoid entry incompatibility↗2014-12-10
▶
CVE-2014-9322 — Improper Privilege Management in Kernel | cvebase