CVE-2014-4014

The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.

CVSS v2.0 6.2 MEDIUM

6.2^/10

CVSS v2.0 : MEDIUM

Vector : AV:L/AC:H/Au:N/C:C/I:C/A:C

Exploitability : 1.9 / Impact : 10.0

Access Vector LOCAL

Access Complexity HIGH

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03	Third Party Advisory
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8	Vendor Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=23adbe12ef7d3d4195e80800ab36b37bee28cd03	Vendor Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1107966	Issue Tracking Third Party Advisory
http://www.openwall.com/lists/oss-security/2014/06/10/4	Mailing List Third Party Advisory
http://www.securitytracker.com/id/1030394	Third Party Advisory VDB Entry
http://www.securityfocus.com/bid/67988	Third Party Advisory VDB Entry
http://www.exploit-db.com/exploits/33824	Third Party Advisory VDB Entry
http://secunia.com/advisories/59220	Third Party Advisory
https://source.android.com/security/bulletin/2016-12-01.html	Third Party Advisory

Advertisement

Configurations

Configuration 1 (hide)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*

Information

Published : 2014-06-23 04:21

Updated : 2018-12-18 06:31

NVD link : CVE-2014-4014

Mitre link : CVE-2014-4014

JSON object : View

CWE

CWE-264

Permissions, Privileges, and Access Controls

Advertisement

Products Affected

linux

linux_kernel

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03", "name": "https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8", "name": "http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=23adbe12ef7d3d4195e80800ab36b37bee28cd03", "name": "http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=23adbe12ef7d3d4195e80800ab36b37bee28cd03", "tags": ["Vendor Advisory"], "refsource": "CONFIRM"}, {"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1107966", "name": "https://bugzilla.redhat.com/show_bug.cgi?id=1107966", "tags": ["Issue Tracking", "Third Party Advisory"], "refsource": "CONFIRM"}, {"url": "http://www.openwall.com/lists/oss-security/2014/06/10/4", "name": "[oss-security] 20140610 CVE-2014-4014: Linux kernel user namespace bug", "tags": ["Mailing List", "Third Party Advisory"], "refsource": "MLIST"}, {"url": "http://www.securitytracker.com/id/1030394", "name": "1030394", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "SECTRACK"}, {"url": "http://www.securityfocus.com/bid/67988", "name": "67988", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "BID"}, {"url": "http://www.exploit-db.com/exploits/33824", "name": "33824", "tags": ["Third Party Advisory", "VDB Entry"], "refsource": "EXPLOIT-DB"}, {"url": "http://secunia.com/advisories/59220", "name": "59220", "tags": ["Third Party Advisory"], "refsource": "SECUNIA"}, {"url": "https://source.android.com/security/bulletin/2016-12-01.html", "name": "https://source.android.com/security/bulletin/2016-12-01.html", "tags": ["Third Party Advisory"], "refsource": "CONFIRM"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-264"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2014-4014", "ASSIGNER": "cve@mitre.org"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 6.2, "accessVector": "LOCAL", "vectorString": "AV:L/AC:H/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "HIGH", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "severity": "MEDIUM", "acInsufInfo": false, "impactScore": 10.0, "obtainAllPrivilege": false, "exploitabilityScore": 1.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}}, "publishedDate": "2014-06-23T11:21Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true, "versionEndExcluding": "3.14.8"}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-12-18T14:31Z"}