CVE-2014-7843
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the...
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
Exploit likelihood
What each source reports
NVD Score used
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
CVE-2014-7843- CVSS 2.0
- 4.9 Medium
AV:L/AC:L/Au:N/C:N/I:N/A:C - Weakness
- CWE-17
- Updated
- 2026-11-02
CVE List No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
CVE-2014-7843- Updated
- 2026-11-02
EUVDEUVD-2014-7697 No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
EUVD-2014-7697- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-8973-h52f-9cxp No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the...
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
GHSA-8973-h52f-9cxp- Updated
- 2026-11-02
OSV No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
CVE-2014-7843- Updated
- 2026-11-02
OSVDEBIAN-CVE-2014-7843 No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
DEBIAN-CVE-2014-7843- Updated
- 2026-11-02
OSVUBUNTU-CVE-2014-7843 No score
The __clear_user function in arch/arm64/lib/clear_user.S in the Linux kernel before 3.17.4 on the ARM64 platform allows local users to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary.
- Record
UBUNTU-CVE-2014-7843- Updated
- 2026-11-02
OSVUSN-2466-1 No score
linux vulnerabilities
A null pointer dereference flaw was discovered in the the Linux kernel's SCTP implementation when ASCONF is used. A remote attacker could exploit this flaw to cause a denial of service (system crash) via a malformed INIT chunk. (CVE-2014-7841)
A race condition with MMIO and PIO transactions in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service (guest OS crash) via a specially crafted application. (CVE-2014-7842)
Miloš Prchlík reported a flaw in how the ARM64 platform handles a single byte overflow in __clear_user. A local user could exploit this flaw to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary. (CVE-2014-7843)
A stack buffer overflow was discovered in the ioctl command handling for the Technotrend/Hauppauge USB DEC devices driver. A local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges. (CVE-2014-8884)
- Record
USN-2466-1- Updated
- 2026-11-02
OSVUSN-2467-1 No score
linux-lts-utopic vulnerabilities
A null pointer dereference flaw was discovered in the the Linux kernel's SCTP implementation when ASCONF is used. A remote attacker could exploit this flaw to cause a denial of service (system crash) via a malformed INIT chunk. (CVE-2014-7841)
A race condition with MMIO and PIO transactions in the KVM (Kernel Virtual Machine) subsystem of the Linux kernel was discovered. A guest OS user could exploit this flaw to cause a denial of service (guest OS crash) via a specially crafted application. (CVE-2014-7842)
Miloš Prchlík reported a flaw in how the ARM64 platform handles a single byte overflow in __clear_user. A local user could exploit this flaw to cause a denial of service (system crash) by reading one byte beyond a /dev/zero page boundary. (CVE-2014-7843)
A stack buffer overflow was discovered in the ioctl command handling for the Technotrend/Hauppauge USB DEC devices driver. A local user could exploit this flaw to cause a denial of service (system crash) or possibly gain privileges. (CVE-2014-8884)
- Record
USN-2467-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
linuxDebian:12 |
before 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
linuxDebian:13 |
before 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
linuxDebian:14 |
before 3.16.7-ckt2-1 | 3.16.7-ckt2-1 |
linuxUbuntu:14.04:LTS |
before 3.13.0-44.73, plus listed versions 3.11.0-12.193.12.0-1.33.12.0-2.53.12.0-2.73.12.0-3.8 Show 45 moreShow less3.12.0-3.93.12.0-4.103.12.0-4.123.12.0-5.133.12.0-7.153.13.0-1.163.13.0-2.173.13.0-3.183.13.0-4.193.13.0-5.203.13.0-6.233.13.0-7.253.13.0-7.263.13.0-8.273.13.0-8.283.13.0-10.303.13.0-11.313.13.0-12.323.13.0-13.333.13.0-14.343.13.0-15.353.13.0-16.363.13.0-17.373.13.0-18.383.13.0-19.393.13.0-19.403.13.0-20.423.13.0-21.433.13.0-22.443.13.0-23.453.13.0-24.463.13.0-24.473.13.0-27.503.13.0-29.533.13.0-30.543.13.0-30.553.13.0-32.573.13.0-33.583.13.0-34.603.13.0-35.623.13.0-36.633.13.0-37.643.13.0-39.663.13.0-40.693.13.0-41.70 |
3.13.0-44.73 |
linux-lts-utopicUbuntu:14.04:LTS |
before 3.16.0-29.39~14.04.1, plus listed versions 3.16.0-25.33~14.04.23.16.0-26.35~14.04.13.16.0-28.37~14.04.13.16.0-28.38~14.04.1 |
3.16.0-29.39~14.04.1 |
linuxUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 3.13.0-44.73, plus listed versions 3.11.0-12.193.12.0-1.33.12.0-2.53.12.0-2.73.12.0-3.8 Show 45 moreShow less3.12.0-3.93.12.0-4.103.12.0-4.123.12.0-5.133.12.0-7.153.13.0-1.163.13.0-2.173.13.0-3.183.13.0-4.193.13.0-5.203.13.0-6.233.13.0-7.253.13.0-7.263.13.0-8.273.13.0-8.283.13.0-10.303.13.0-11.313.13.0-12.323.13.0-13.333.13.0-14.343.13.0-15.353.13.0-16.363.13.0-17.373.13.0-18.383.13.0-19.393.13.0-19.403.13.0-20.423.13.0-21.433.13.0-22.443.13.0-23.453.13.0-24.463.13.0-24.473.13.0-27.503.13.0-29.533.13.0-30.543.13.0-30.553.13.0-32.573.13.0-33.583.13.0-34.603.13.0-35.623.13.0-36.633.13.0-37.643.13.0-39.663.13.0-40.693.13.0-41.70 |
3.13.0-44.73 |
linux-lts-utopicUbuntu:14.04:LTS From an advisory covering 4 CVEs |
before 3.16.0-29.39~14.04.1, plus listed versions 3.16.0-25.33~14.04.23.16.0-26.35~14.04.13.16.0-28.37~14.04.13.16.0-28.38~14.04.1 |
3.16.0-29.39~14.04.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2014-7843 is a medium vulnerability (CVSS 4.9) in Linux Kernel, published November 29, 2014. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.37%, the 31st percentile. Fixed in linux 3.16.7-ckt2-1.
References
openwall.com/lists/oss-security/2014/11/13/5
github.com/torvalds/linux/commit/97fc15436b36ee3956efad83e22a557991f7d19d
git.kernel.org?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=97fc15436b36ee3956efad83e22a557991f7d19d
bugzilla.redhat.com/show_bug.cgi?id=1163744
securityfocus.com/bid/71082
kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.4
Show 14 moreShow less
secunia.com/advisories/62305
nvd.nist.gov/vuln/detail/CVE-2014-7843
security-tracker.debian.org/tracker/CVE-2014-7843
ubuntu.com/security/CVE-2014-7843
cve.org/CVERecord?id=CVE-2014-7843
Left out here: 2 versions. The JSON record has them.