Every CVE Search/ Get API key

CVE-2014-9114

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

7.8 HighFix available

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Attack profile

How easy it is to exploit

Attack vector
Local
Complexity
Low
Privileges needed
Low
User interaction
None

What an attacker can affect

Confidentiality
High
Integrity
High
Availability
High

Exploit likelihood

0.64%Down 1.3 points since Feb 4, 2022
90%50%10%1%

What each source reports

CVE List 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
CVE-2014-9114
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
EUVDEUVD-2014-8940 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
EUVD-2014-8940
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-g7m2-8cqp-hf7v 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
GHSA-g7m2-8cqp-hf7v
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness
CWE-77
Updated
2026-11-02
NVD 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
CVE-2014-9114
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0
7.2 HighAV:L/AC:L/Au:N/C:C/I:C/A:C
Weakness
CWE-77
Updated
2026-11-02
OSVBELL-CVE-2014-9114 7.8

CVE-2014-9114 does not affect BellSoft software

Record
BELL-CVE-2014-9114
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSV 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
CVE-2014-9114
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
Show 6 moreShow less
OSVDEBIAN-CVE-2014-9114 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
DEBIAN-CVE-2014-9114
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2014-9114 7.8

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Record
UBUNTU-CVE-2014-9114
CVSS 3.1
7.8 HighCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.0
7.8 HighCVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Updated
2026-11-02
OSVMGASA-2014-0517 No score

Updated util-linux packages fix CVE-2014-9114

Updated util-linux packages fix security vulnerability:

Sebastian Krahmer reported a command injection flaw in blkid. This could possibly result in command execution with root privileges (CVE-2014-9114).

The util-linux package has been updated to version 2.24.2 and patched to fix this issue and other bugs.

Record
MGASA-2014-0517
Updated
2026-11-02
OSVopenSUSE-SU-2024:10279-1 No score

libblkid-devel-2.28.2-2.1 on GA media

These are all security issues fixed in the libblkid-devel-2.28.2-2.1 package on the GA media of openSUSE Tumbleweed.

Record
openSUSE-SU-2024:10279-1
Updated
2026-11-02
OSVSUSE-SU-2015:0270-1 No score

Security update for util-linux

util-linux was updated to fix one security issue.

This security issue was fixed:

  • CVE-2014-9114: Using crafted block devices (e.g. USB sticks) it was possibly to inject code via libblkid. libblkid was fixed to care about unsafe chars and possible buffer overflow in cache (bnc#907434)

This non-security issue was fixed:

  • libblkid: Reset errno in blkid_probe_get_buffer() to prevent failing probes (e. g. for exFAT) (bnc#908742).
Record
SUSE-SU-2015:0270-1
Updated
2026-11-02
OSVSUSE-SU-2015:0580-1 No score

Recommended update for util-linux

This update for util-linux provides the following fixes:

* Make blkid(8) issue only one READ on faulty devices. (bnc#859062)
* Added option -r to fsck(8) to dump a few resource statistics after
  each successful run. (bnc#761815)
* Prevent excessive clock drift calculations. (bnc#871698)
* Check /etc/adjtime drift factor. (bnc#871698)
* Prevent hang in exact hwclock adjustment. (bnc#871698)
* Suppress warning that's not relevant on Linux systems. (bnc#871698)
Record
SUSE-SU-2015:0580-1
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
util-linux
Debian:12
 before 2.25.2-4
2.25.2-4
util-linux
Debian:13
 before 2.25.2-4
2.25.2-4
util-linux
Debian:14
 before 2.25.2-4
2.25.2-4
util-linux
Mageia:4
 before 2.24.2-1.mga4
2.24.2-1.mga4
python-libmount
SUSE:Linux Enterprise Desktop 12
 before 2.25-10.3
2.25-10.3
util-linux
SUSE:Linux Enterprise Desktop 12
 before 2.25-10.1
2.25-10.1
util-linux-systemd
SUSE:Linux Enterprise Desktop 12
 before 2.25-10.1
2.25-10.1
util-linux
SUSE:Linux Enterprise Software Development Kit 12
 before 2.25-10.1
2.25-10.1
python-libmount
SUSE:Linux Enterprise Server 12
 before 2.25-10.3
2.25-10.3
util-linux
SUSE:Linux Enterprise Server 12
 before 2.25-10.1
2.25-10.1
Show 7 moreShow less
Affected packages
PackageAffectedFixed
util-linux-systemd
SUSE:Linux Enterprise Server 12
 before 2.25-10.1
2.25-10.1
python-libmount
SUSE:Linux Enterprise Server for SAP Applications 12
 before 2.25-10.3
2.25-10.3
util-linux
SUSE:Linux Enterprise Server for SAP Applications 12
 before 2.25-10.1
2.25-10.1
util-linux-systemd
SUSE:Linux Enterprise Server for SAP Applications 12
 before 2.25-10.1
2.25-10.1
util-linux
SUSE:Linux Enterprise Workstation Extension 12
 before 2.25-10.1
2.25-10.1
util-linux
Ubuntu:14.04:LTS
 All versions, plus listed versions
2.20.1-5.1ubuntu92.20.1-5.1ubuntu102.20.1-5.1ubuntu112.20.1-5.1ubuntu122.20.1-5.1ubuntu13
Show 14 moreShow less
2.20.1-5.1ubuntu142.20.1-5.1ubuntu152.20.1-5.1ubuntu162.20.1-5.1ubuntu172.20.1-5.1ubuntu182.20.1-5.1ubuntu192.20.1-5.1ubuntu202.20.1-5.1ubuntu20.12.20.1-5.1ubuntu20.22.20.1-5.1ubuntu20.32.20.1-5.1ubuntu20.42.20.1-5.1ubuntu20.62.20.1-5.1ubuntu20.72.20.1-5.1ubuntu20.9
 None known
util-linux
openSUSE:Tumbleweed
 before 2.28.2-2.1
2.28.2-2.1

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2014-9114 is a high vulnerability (CVSS 7.8) in Kernel Util-linux, published June 4, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.64%, the 50th percentile. Fixed in util-linux 2.25.2-4.

References

Show 32 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open