{"id":"CVE-2014-0038","aliases":["DEBIAN-CVE-2014-0038","EUVD-2014-0135","GHSA-wvfw-q8jv-g9r2","MGASA-2014-0038","MGASA-2014-0039","MGASA-2014-0043","MGASA-2014-0044","MGASA-2014-0045","MGASA-2014-0046","MGASA-2014-0055","MGASA-2014-0061","MGASA-2014-0063","MGASA-2014-0064","SUSE-SU-2017:3210-1","SUSE-SU-2017:3249-1","openSUSE-SU-2024:10128-1"],"status":"published","title":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when...","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","severity":{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.35451,"percentile":0.98462,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2014-02-06T22:00:00Z","modified":"2026-10-23T15:47:37Z","exploits":[{"source":"exploitdb","id":"EDB-31305","title":"Linux Kernel 3.4 \u003c 3.13.2 - recvmmsg x32 compat (PoC)","type":"dos","platform":"linux","date":"2014-01-31","url":"https://www.exploit-db.com/exploits/31305"},{"source":"exploitdb","id":"EDB-31346","title":"Linux Kernel 3.4 \u003c 3.13.2 (Ubuntu 13.10) - 'CONFIG_X86_X32' Arbitrary Write (2)","type":"local","platform":"linux","date":"2014-02-02","verified":true,"url":"https://www.exploit-db.com/exploits/31346"},{"source":"exploitdb","id":"EDB-31347","title":"Linux Kernel 3.4 \u003c 3.13.2 (Ubuntu 13.04/13.10 x64) - 'CONFIG_X86_X32=y' Local Privilege Escalation (3)","type":"local","platform":"linux_x86-64","date":"2014-02-02","verified":true,"url":"https://www.exploit-db.com/exploits/31347"},{"source":"metasploit","id":"exploit/linux/local/recvmmsg_priv_esc","title":"Linux Kernel recvmmsg Privilege Escalation","type":"exploit","platform":"Linux","date":"2014-02-02","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/linux/local/recvmmsg_priv_esc"},{"source":"pocgithub","id":"saelo/cve-2014-0038","title":"saelo/cve-2014-0038","date":"2014-02-02","url":"https://github.com/saelo/cve-2014-0038"},{"source":"exploitdb","id":"EDB-40503","title":"Linux Kernel 3.13.1 - 'Recvmmsg' Local Privilege Escalation (Metasploit)","type":"local","platform":"linux","date":"2016-10-11","verified":true,"url":"https://www.exploit-db.com/exploits/40503"},{"source":"pocgithub","id":"kiruthikan99/IT19115276","title":"kiruthikan99/IT19115276","date":"2020-05-12","url":"https://github.com/kiruthikan99/IT19115276"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.13.4-1"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel","fixed_in":["3.12.9-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-userspace-headers","fixed_in":["3.12.9-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-vboxadditions","fixed_in":["4.3.6-9.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-virtualbox","fixed_in":["4.3.6-9.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-xtables-addons","fixed_in":["2.3-41.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-broadcom-wl","fixed_in":["6.30.223.141-25.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-fglrx","fixed_in":["13.251-10.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia173","fixed_in":["173.14.39-11.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia304","fixed_in":["304.119-3.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kmod-nvidia-current","fixed_in":["325.15-7.mga4.nonfree"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-tmb","fixed_in":["3.12.9-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-linus","fixed_in":["3.12.9-1.mga4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"kernel-rt","fixed_in":["3.12.9-0.rt13.1.mga4"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.4-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-7.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.16-7.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-11.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.251-1.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-10.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.251-3.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.38-27.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.108-12.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"319.60-11.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-9.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.6-9.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-41.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-25.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.251-10.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-11.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.119-3.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"325.15-7.mga4.nonfree"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-1.mga3"}]}],"bundled":10},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-0.rt25.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-0.vs2.3.6.8.1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9-1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.9-0.rt13.1.mga4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.28-0.vs2.3.6.8.1.mga4"}]}],"bundled":5},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"kgraft-patch-SLE12-SP1_Update_23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12 SP1","package":"kgraft-patch-SLE12-SP1_Update_23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.74-60.64.66.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12 SP1-LTSS","package":"kgraft-patch-SLE12-SP1_Update_23","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-2.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 12","package":"kernel-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.106.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-default","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.106.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.106.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-syms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.106.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kernel-xen","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.61-52.106.1"}]}],"bundled":14},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12-LTSS","package":"kgraft-patch-SLE12_Update_29","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1-5.1"}]}],"bundled":14},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"kernel-source","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.8.13-1.1"}]}],"bundled":82}],"products":[{"vendor":"linux","product":"linux_kernel"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2096-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://github.com/saelo/cve-2014-0038","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2095-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://pastebin.com/raw.php?i=DH3Lbg54","tags":["x_refsource_MISC","x_transferred","Exploit","evidence"]},{"url":"https://code.google.com/p/chromium/issues/detail?id=338594","tags":["x_refsource_MISC","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2094-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2014:038","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/56669","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Not Applicable","advisory"]},{"url":"http://www.securityfocus.com/bid/65255","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix"]},{"url":"https://www.exploit-db.com/exploits/40503/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1060023","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","report"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.exploit-db.com/exploits/31347","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.exploit-db.com/exploits/31346","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/01/31/2","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","article"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-0038"},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=2def2ef2ae5f3990aabdbe8a755911902707d268"},{"url":"https://www.exploit-db.com/exploits/40503"},{"url":"https://github.com/advisories/GHSA-wvfw-q8jv-g9r2"},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-0038","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0038.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=6077","tags":["report"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12517","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.25","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.26","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.27","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.28","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0039.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12522","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.9","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0043.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12518","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0044.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12519","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0045.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12520","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0046.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12525","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0055.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12521","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0061.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12523","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0063.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12524","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0064.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=12526","tags":["report"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173210-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1047626","tags":["report"]},{"url":"https://bugzilla.suse.com/1059465","tags":["report"]},{"url":"https://bugzilla.suse.com/1066471","tags":["report"]},{"url":"https://bugzilla.suse.com/1066472","tags":["report"]},{"url":"https://bugzilla.suse.com/1069496","tags":["report"]},{"url":"https://bugzilla.suse.com/860993","tags":["report"]},{"url":"https://bugzilla.suse.com/975788","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0038","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-1000405","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-12193","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-15102","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16525","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16527","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16529","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16531","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16535","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16537","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16649","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16650","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2017-16939","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20173249-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1043652","tags":["report"]},{"url":"https://bugzilla.suse.com/1066192","tags":["report"]},{"url":"https://bugzilla.suse.com/1066573","tags":["report"]},{"url":"https://bugzilla.suse.com/1066606","tags":["report"]},{"url":"https://bugzilla.suse.com/1066618","tags":["report"]},{"url":"https://bugzilla.suse.com/1066625","tags":["report"]},{"url":"https://bugzilla.suse.com/1066650","tags":["report"]},{"url":"https://bugzilla.suse.com/1066671","tags":["report"]},{"url":"https://bugzilla.suse.com/1066700","tags":["report"]},{"url":"https://bugzilla.suse.com/1066705","tags":["report"]},{"url":"https://bugzilla.suse.com/1067085","tags":["report"]},{"url":"https://bugzilla.suse.com/1067086","tags":["report"]},{"url":"https://bugzilla.suse.com/1067997","tags":["report"]},{"url":"https://bugzilla.suse.com/1069702","tags":["report"]},{"url":"https://bugzilla.suse.com/1069708","tags":["report"]},{"url":"https://bugzilla.suse.com/1070307","tags":["report"]},{"url":"https://bugzilla.suse.com/1070781","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2009-3939","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4026","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4027","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4131","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4138","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4536","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2009-4538","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1146","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1436","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-1641","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2066","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2942","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2954","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-2955","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3081","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3296","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3297","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3298","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3301","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2010-3310","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0711","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-0712","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1020","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1180","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-1581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-2203","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2011-4604","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-0056","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3412","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2012-3520","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0160","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0231","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2013-2850","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0196","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-0691","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-8133","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-1333","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7550","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7884","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7885","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8539","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-8660","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0723","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0728","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1237","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-1583","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2184","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2185","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2186","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2384","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3134","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3135","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3136","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3140","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3689","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-3713","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4470","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4485","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4486","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4557","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4558","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4569","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4951","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4997","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-4998","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5195","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5244","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-5829","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6187","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6480","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6516","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6828","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7039","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7042","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7425","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-7913","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9555","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-9576","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-0038","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2014-02-06T22:00:00Z","modified":"2024-08-06T08:58:26.62Z","updated_at":"2026-11-02T14:33:47.741012Z"}],"euvd":[{"id":"EUVD-2014-0135","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2014-02-06T22:00:00Z","modified":"2024-08-06T08:58:26Z","updated_at":"2026-11-03T01:57:23.42372Z"}],"ghsa":[{"id":"GHSA-wvfw-q8jv-g9r2","title":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when...","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2022-05-14T04:01:13Z","modified":"2025-04-11T04:20:04Z","cwes":["CWE-20"],"updated_at":"2026-11-02T15:01:15.928203Z"}],"nvd":[{"id":"CVE-2014-0038","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2014-02-06T22:55:03.327Z","modified":"2026-06-17T00:02:08.27Z","cvss":[{"version":"2.0","score":6.9,"vector":"AV:L/AC:M/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:02:53.330367Z"}],"osv":[{"id":"CVE-2014-0038","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2014-02-06T22:55:03Z","modified":"2026-04-16T06:17:48.12998789Z","updated_at":"2026-11-02T15:43:59.361892Z"},{"id":"DEBIAN-CVE-2014-0038","description":"The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.","status":"published","published":"2014-02-06T22:55:03.327Z","modified":"2026-10-23T15:47:37.550590114Z","updated_at":"2026-11-02T15:45:25.819707Z"},{"id":"MGASA-2014-0038","title":"Updated kernel package fixes one critical and a few other security issues","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nIt also fixes an issue where some laptops are forced to use\nvesa driver \u0026 No ACPI (mga#6077)\n\nFor other upstream fixes, see the referenced changelogs.\n\nThe proprietary fglrx driver has also been updated from Catalyst\n13.11-beta6 to Catalyst 13.12 official driver.\n","status":"published","published":"2014-02-08T19:01:59Z","modified":"2026-04-16T06:25:36.178691992Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0039","title":"Updated kernel package fixes a critical security issue","description":"This kernel update provides an update to 3.12.9 and fixes the following\ncritical security issue:\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nIt also fixes an issue where some laptops are forced to use\nvesa driver \u0026 No ACPI (mga#6077)\n\nFor other changes, see the referenced changelog.\n","status":"published","published":"2014-02-08T19:09:10Z","modified":"2026-04-16T06:24:26.878395014Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0043","title":"Updated kernel-linus package fixes multiple vulnerabilities","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nArray index error in the kvm_vm_ioctl_create_vcpu function in \nvirt/kvm/kvm_main.c in the KVM subsystem in the Linux kernel through\n3.12.5 allows local users to gain privileges via a large id value\n(CVE-2013-4587)\n\nThe apic_get_tmcct function in arch/x86/kvm/lapic.c in the KVM subsystem\nin the Linux kernel through 3.12.5 allows guest OS users to cause a denial\nof service (divide-by-zero error and host OS crash) via crafted\nmodifications of the TMICT value. (CVE-2013-6367)\n\nThe KVM subsystem in the Linux kernel through 3.12.5 allows local users to\ngain privileges or cause a denial of service (system crash) via a VAPIC\nsynchronization operation involving a page-end address.  (CVE-2013-6368)\n\nThe recalculate_apic_map function in arch/x86/kvm/lapic.c in the KVM\nsubsystem  in the Linux kernel through 3.12.5 allows guest OS users to\ncause a denial of service (host OS crash) via a crafted ICR write\noperation in x2apic mode. (CVE-2013-6376)\n\nMultiple buffer underflows in the XFS implementation in the Linux kernel\nthrough 3.12.1 allow local users to cause a denial of service (memory\ncorruption) or possibly have unspecified other impact by leveraging the\nCAP_SYS_ADMIN capability for a (1) XFS_IOC_ATTRLIST_BY_HANDLE or (2)\nXFS_IOC_ATTRLIST_BY_HANDLE_32 ioctl call with a crafted length value,\nrelated to the xfs_attrlist_by_handle function in fs/xfs/xfs_ioctl.c\nand the xfs_compat_attrlist_by_handle function in fs/xfs/xfs_ioctl32.c.\n(CVE-2013-6382)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2014-02-10T20:03:47Z","modified":"2026-04-16T06:25:18.220749727Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0044","title":"Updated kernel-rt packages fix multiple vulnerabilities","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nThe -rt patch has been updated to -rt25\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2014-02-10T20:06:51Z","modified":"2026-04-16T06:26:02.002006243Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0045","title":"Updated kernel-tmb packages fix multiple vulnerabilities","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2014-02-10T20:09:03Z","modified":"2026-04-16T06:26:21.215125599Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0046","title":"Updated kernel-tmb packages fix CVE-2014-0038","description":"This kernel update provides an update to 3.12.9 and fixes the following\ncritical security issue:\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFor other changes, see the referenced changelog:\n","status":"published","published":"2014-02-10T20:13:44Z","modified":"2026-04-16T06:25:34.793533215Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0055","title":"Updated kernel-vserver packages fix multiple vulnerabilities","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nFor other changes, see the referenced changelogs:\n","status":"published","published":"2014-02-11T22:38:44Z","modified":"2026-04-16T06:23:28.368599225Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0061","title":"Updated kernel-linus package fixes security vulnerability","description":"This kernel update provides an update to 3.12.9 and fixes the following\ncritical security issue:\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038).\n\nOther changes are in the referenced changelog.\n","status":"published","published":"2014-02-12T17:17:13Z","modified":"2026-04-16T06:23:35.550853021Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0063","title":"Updated kernel-rt packages fix security vulnerability","description":"This kernel update provides an update to 3.12.9 and fixes the following\ncritical security issue:\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nThe -rt patch has been updated to -rt13.\n\nFor other changes, see the referenced changelog\n","status":"published","published":"2014-02-12T22:48:23Z","modified":"2026-04-16T06:24:25.274745274Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"MGASA-2014-0064","title":"Updated kernel-vserver packages fix security vulnerability","description":"This kernel update provides an update to the 3.10 longterm branch,\ncurrently 3.10.28 and fixes the following security issues:\n\nThe ath9k_htc_set_bssid_mask function in \ndrivers/net/wireless/ath/ath9k/htc_drv_main.c in the Linux kernel through\n3.12 uses a BSSID masking approach to determine the set of MAC addresses\non which a Wi-Fi device is listening, which allows remote attackers to\ndiscover the original MAC address after spoofing by sending a series of\npackets to MAC addresses with certain bit manipulations. (CVE-2013-4579)\n\nPageexec reported a bug in the Linux kernel's recvmmsg syscall when called\nfrom code using the x32 ABI. An unprivileged local user could exploit this\nflaw to cause a denial of service (system crash) or gain administrator\nprivileges (CVE-2014-0038)\n\nFaults during task-switch due to unhandled FPU-exceptions allow to\nkill processes at random on all affected kernels, resulting in local\nDOS in the end. One some architectures, privilege escalation under\nnon-common circumstances is possible. (CVE-2014-1438)\n\nThe hamradio yam_ioctl() code fails to initialise the cmd field of the\nstruct yamdrv_ioctl_cfg leading to a 4-byte info leak. (CVE-2014-1446)\n\nLinux kernel built with the NetFilter Connection Tracking(NF_CONNTRACK)\nsupport for IRC protocol(NF_NAT_IRC), is vulnerable to an information\nleakage flaw. It could occur when communicating over direct\nclient-to-client IRC connection(/dcc) via a NAT-ed network. Kernel\nattempts to mangle IRC TCP packet's content, wherein an uninitialised\n'buffer' object is copied to a socket buffer and sent over to the other\nend of a connection. (CVE-2014-1690)\n\nFor other changes, see the referenced changelogs\n","status":"published","published":"2014-02-12T22:53:19Z","modified":"2026-04-16T06:23:31.709423062Z","updated_at":"2026-11-02T15:49:39.121227Z"},{"id":"openSUSE-SU-2024:10128-1","title":"kernel-debug-4.8.13-1.1 on GA media","description":"These are all security issues fixed in the kernel-debug-4.8.13-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T04:10:12.688384Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2017:3210-1","title":"Security update for the Linux Kernel","description":"\n\nThe SUSE Linux Enterprise 12 SP1 kernel was updated to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages. (bnc#1069702)\n- CVE-2017-1000405: mm, thp: do not dirty huge pages on read fault (bnc#1069496).\n- CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067085)\n- CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c, when CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter (bnc#860993).\n- CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1067086)\n- CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066700)\n- CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference. (bnc#1066705)\n- CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor. (bnc#1066671)\n- CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations. (bnc#1066192)\n- CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066650)\n- CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup. (bnc#1066618)\n- CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066573)\n- CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066606)\n- CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device. (bnc#1066625)\n\nThe following non-security bugs were fixed:\n\n- NVMe: No lock while DMA mapping data (bsc#975788).\n- bcache: Add bch_keylist_init_single() (bsc#1047626).\n- bcache: Add btree_map() functions (bsc#1047626).\n- bcache: Add on error panic/unregister setting (bsc#1047626).\n- bcache: Convert gc to a kthread (bsc#1047626).\n- bcache: Delete some slower inline asm (bsc#1047626).\n- bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626).\n- bcache: Fix a bug recovering from unclean shutdown (bsc#1047626).\n- bcache: Fix a journalling reclaim after recovery bug (bsc#1047626).\n- bcache: Fix a null ptr deref in journal replay (bsc#1047626).\n- bcache: Fix an infinite loop in journal replay (bsc#1047626).\n- bcache: Fix bch_ptr_bad() (bsc#1047626).\n- bcache: Fix discard granularity (bsc#1047626).\n- bcache: Fix for can_attach_cache() (bsc#1047626).\n- bcache: Fix heap_peek() macro (bsc#1047626).\n- bcache: Fix moving_pred() (bsc#1047626).\n- bcache: Fix to remove the rcu_sched stalls (bsc#1047626).\n- bcache: Improve bucket_prio() calculation (bsc#1047626).\n- bcache: Improve priority_stats (bsc#1047626).\n- bcache: Minor btree cache fix (bsc#1047626).\n- bcache: Move keylist out of btree_op (bsc#1047626).\n- bcache: New writeback PD controller (bsc#1047626).\n- bcache: PRECEDING_KEY() (bsc#1047626).\n- bcache: Performance fix for when journal entry is full (bsc#1047626).\n- bcache: Remove redundant block_size assignment (bsc#1047626).\n- bcache: Remove redundant parameter for cache_alloc() (bsc#1047626).\n- bcache: Remove/fix some header dependencies (bsc#1047626).\n- bcache: Trivial error handling fix (bsc#1047626).\n- bcache: Use ida for bcache block dev minor (bsc#1047626).\n- bcache: allows use of register in udev to avoid 'device_busy' error (bsc#1047626).\n- bcache: bch_allocator_thread() is not freezable (bsc#1047626).\n- bcache: bch_gc_thread() is not freezable (bsc#1047626).\n- bcache: bugfix - gc thread now gets woken when cache is full (bsc#1047626).\n- bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626).\n- bcache: cleaned up error handling around register_cache() (bsc#1047626).\n- bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bsc#1047626).\n- bcache: defensively handle format strings (bsc#1047626).\n- bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED (bsc#1047626).\n- bcache: fix a livelock when we cause a huge number of cache misses (bsc#1047626).\n- bcache: fix crash in bcache_btree_node_alloc_fail tracepoint (bsc#1047626).\n- bcache: fix for gc and writeback race (bsc#1047626).\n- bcache: fix for gc crashing when no sectors are used (bsc#1047626).\n- bcache: kill index() (bsc#1047626).\n- bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1047626).\n- bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626).\n- mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).\n- mac80211: use constant time comparison with keys (bsc#1066471).\n- packet: fix use-after-free in fanout_add()\n- scsi: ILLEGAL REQUEST + ASC==27 produces target failure (bsc#1059465).\n","status":"published","published":"2017-12-04T10:40:05Z","modified":"2026-02-04T04:08:12.874948Z","updated_at":"2026-11-02T15:53:44.209561Z"},{"id":"SUSE-SU-2017:3249-1","title":"Security update for the Linux Kernel","description":"\nThe SUSE Linux Enterprise 12 kernel was updated to 3.12.61 to receive various security and bugfixes.\n\nThe following security bugs were fixed:\n\n- CVE-2017-16939: The XFRM dump policy implementation in net/xfrm/xfrm_user.c in the Linux kernel allowed local users to gain privileges or cause a denial of service (use-after-free) via a crafted SO_RCVBUF setsockopt system call in conjunction with XFRM_MSG_GETPOLICY Netlink messages (bnc#1069702 1069708).\n- CVE-2017-1000405: The Linux Kernel had a problematic use of pmd_mkdirty() in the touch_pmd() function inside the THP implementation. touch_pmd() could be reached by get_user_pages(). In such case, the pmd would become dirty. This scenario breaks the new can_follow_write_pmd()'s logic - pmd could become dirty without going through a COW cycle. This bug was not as severe as the original 'Dirty cow' because an ext4 file (or any other regular file) could not be mapped using THP. Nevertheless, it did allow us to overwrite read-only huge pages. For example, the zero huge page and sealed shmem files could be overwritten (since their mapping could be populated using THP). Note that after the first write page-fault to the zero page, it will be replaced with a new fresh (and zeroed) thp (bnc#1069496 1070307).\n- CVE-2017-16649: The usbnet_generic_cdc_bind function in drivers/net/usb/cdc_ether.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067085).\n- CVE-2014-0038: The compat_sys_recvmmsg function in net/compat.c in the Linux kernel, when CONFIG_X86_X32 is enabled, allowed local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter (bnc#860993).\n- CVE-2017-16650: The qmi_wwan_bind function in drivers/net/usb/qmi_wwan.c in the Linux kernel allowed local users to cause a denial of service (divide-by-zero error and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1067086).\n- CVE-2017-16535: The usb_get_bos_descriptor function in drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066700).\n- CVE-2017-15102: The tower_probe function in drivers/usb/misc/legousbtower.c in the Linux kernel allowed local users (who are physically proximate for inserting a crafted USB device) to gain privileges by leveraging a write-what-where condition that occurs after a race condition and a NULL pointer dereference (bnc#1066705).\n- CVE-2017-16531: drivers/usb/core/config.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device, related to the USB_DT_INTERFACE_ASSOCIATION descriptor (bnc#1066671).\n- CVE-2017-12193: The assoc_array_insert_into_terminal_node function in lib/assoc_array.c in the Linux kernel mishandled node splitting, which allowed local users to cause a denial of service (NULL pointer dereference and panic) via a crafted application, as demonstrated by the keyring key type, and key addition and link creation operations (bnc#1066192).\n- CVE-2017-16529: The snd_usb_create_streams function in sound/usb/card.c in the Linux kernel allowed local users to cause a denial of service (out-of-bounds read and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066650).\n- CVE-2017-16525: The usb_serial_console_disconnect function in drivers/usb/serial/console.c in the Linux kernel allowed local users to cause a denial of service (use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device, related to disconnection and failed setup (bnc#1066618).\n- CVE-2017-16537: The imon_probe function in drivers/media/rc/imon.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066573).\n- CVE-2017-16536: The cx231xx_usb_probe function in drivers/media/usb/cx231xx/cx231xx-cards.c in the Linux kernel allowed local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066606).\n- CVE-2017-16527: sound/usb/mixer.c in the Linux kernel allowed local users to cause a denial of service (snd_usb_mixer_interrupt use-after-free and system crash) or possibly have unspecified other impact via a crafted USB device (bnc#1066625).\n\nThe following non-security bugs were fixed:\n\n- Define sock_efree (bsc#1067997).\n- bcache: Add bch_keylist_init_single() (bsc#1047626).\n- bcache: Add btree_map() functions (bsc#1047626).\n- bcache: Add on error panic/unregister setting (bsc#1047626).\n- bcache: Convert gc to a kthread (bsc#1047626).\n- bcache: Delete some slower inline asm (bsc#1047626).\n- bcache: Drop unneeded blk_sync_queue() calls (bsc#1047626).\n- bcache: Fix a bug recovering from unclean shutdown (bsc#1047626).\n- bcache: Fix a journalling reclaim after recovery bug (bsc#1047626).\n- bcache: Fix a null ptr deref in journal replay (bsc#1047626).\n- bcache: Fix an infinite loop in journal replay (bsc#1047626).\n- bcache: Fix bch_ptr_bad() (bsc#1047626).\n- bcache: Fix discard granularity (bsc#1047626).\n- bcache: Fix for can_attach_cache() (bsc#1047626).\n- bcache: Fix heap_peek() macro (bsc#1047626).\n- bcache: Fix moving_pred() (bsc#1047626).\n- bcache: Fix to remove the rcu_sched stalls (bsc#1047626).\n- bcache: Improve bucket_prio() calculation (bsc#1047626).\n- bcache: Improve priority_stats (bsc#1047626).\n- bcache: Minor btree cache fix (bsc#1047626).\n- bcache: Move keylist out of btree_op (bsc#1047626).\n- bcache: New writeback PD controller (bsc#1047626).\n- bcache: PRECEDING_KEY() (bsc#1047626).\n- bcache: Performance fix for when journal entry is full (bsc#1047626).\n- bcache: Remove redundant block_size assignment (bsc#1047626).\n- bcache: Remove redundant parameter for cache_alloc() (bsc#1047626).\n- bcache: Remove/fix some header dependencies (bsc#1047626).\n- bcache: Trivial error handling fix (bsc#1047626).\n- bcache: Use ida for bcache block dev minor (bsc#1047626).\n- bcache: allows use of register in udev to avoid 'device_busy' error (bsc#1047626).\n- bcache: bch_allocator_thread() is not freezable (bsc#1047626).\n- bcache: bch_gc_thread() is not freezable (bsc#1047626).\n- bcache: bugfix - gc thread now gets woken when cache is full (bsc#1047626).\n- bcache: bugfix - moving_gc now moves only correct buckets (bsc#1047626).\n- bcache: cleaned up error handling around register_cache() (bsc#1047626).\n- bcache: clear BCACHE_DEV_UNLINK_DONE flag when attaching a backing device (bsc#1047626).\n- bcache: defensively handle format strings (bsc#1047626).\n- bcache: fix BUG_ON due to integer overflow with GC_SECTORS_USED (bsc#1047626).\n- bcache: fix a livelock when we cause a huge number of cache misses (bsc#1047626).\n- bcache: fix crash in bcache_btree_node_alloc_fail tracepoint (bsc#1047626).\n- bcache: fix for gc and writeback race (bsc#1047626).\n- bcache: fix for gc crashing when no sectors are used (bsc#1047626).\n- bcache: kill index() (bsc#1047626).\n- bcache: only recovery I/O error for writethrough mode (bsc#1043652).\n- bcache: register_bcache(): call blkdev_put() when cache_alloc() fails (bsc#1047626).\n- bcache: stop moving_gc marking buckets that can't be moved (bsc#1047626).\n- mac80211: do not compare TKIP TX MIC key in reinstall prevention (bsc#1066472).\n- mac80211: use constant time comparison with keys (bsc#1066471).\n- powerpc/powernv: Remove OPAL v1 takeover (bsc#1070781).\n- powerpc/vdso64: Use double word compare on pointers\n- powerpc: Convert cmp to cmpd in idle enter sequence\n","status":"published","published":"2017-12-08T11:42:24Z","modified":"2026-02-04T02:55:53.85682Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}