{"id":"CVE-2014-4014","aliases":["BELL-CVE-2014-4014","DEBIAN-CVE-2014-4014","EUVD-2014-3946","GHSA-73cf-9h72-w34c","MGASA-2014-0273","MGASA-2014-0316","MGASA-2014-0330","MGASA-2014-0331","MGASA-2014-0332","MGASA-2014-0336","MGASA-2014-0337","MGASA-2015-0077","UBUNTU-CVE-2014-4014","USN-2337-1"],"status":"published","title":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that...","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","severity":{"version":"2.0","score":6.2,"vector":"AV:L/AC:H/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.03303,"percentile":0.88603,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-264"],"published":"2014-06-22T21:13:23Z","modified":"2026-10-23T15:47:30Z","exploits":[{"source":"exploitdb","id":"EDB-33824","title":"Linux Kernel 3.13 - SGID Privilege Escalation","type":"local","platform":"linux","date":"2014-06-21","verified":true,"url":"https://www.exploit-db.com/exploits/33824"},{"source":"pocgithub","id":"vnik5287/cve-2014-4014-privesc","title":"vnik5287/cve-2014-4014-privesc","date":"2019-07-23","url":"https://github.com/vnik5287/cve-2014-4014-privesc"}],"fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.14.7-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.14.7-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.14.7-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-35.62"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.7-1"}]}]},{"source":"osv","ecosystem":"Mageia:3","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.44-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.44-1.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-7.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-7.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-17.mga3"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-17.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"13.251-7.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.38-32.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.108-17.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:3","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"319.60-17.mga3.nonfree"}]}],"bundled":5},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.25-3.mga4"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.25-3.mga4"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-10.mga4"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.10-10.mga4"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.3-50.mga4"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-35.mga4.nonfree"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.010.1006-5.mga4.nonfree"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-20.mga4.nonfree"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.119-15.mga4.nonfree"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331.79-5.mga4.nonfree"}]}],"bundled":6},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.51-1.mga3"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.51-1.mga3"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:3","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.51-0.vs2.3.6.8.1.mga3"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.10.51-0.vs2.3.6.8.1.mga4"}]}],"bundled":8},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.26-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.12.26-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-0.rt28.1.mga4"}]}],"bundled":29},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-35.62"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-35.62"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60"],"bundled":14}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://www.securityfocus.com/bid/67988","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://source.android.com/security/bulletin/2016-12-01.html","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securitytracker.com/id/1030394","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.exploit-db.com/exploits/33824","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","advisory"]},{"url":"https://github.com/torvalds/linux/commit/23adbe12ef7d3d4195e80800ab36b37bee28cd03","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory"]},{"url":"http://secunia.com/advisories/59220","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1107966","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Third Party Advisory","advisory","report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/06/10/4","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=23adbe12ef7d3d4195e80800ab36b37bee28cd03","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-4014"},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=23adbe12ef7d3d4195e80800ab36b37bee28cd03"},{"url":"https://github.com/advisories/GHSA-73cf-9h72-w34c"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-4014","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-4014","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0273.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13487","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.41","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.42","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.43","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.44","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0316.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13801","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.22","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.23","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.24","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.25","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0330.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13864","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.51","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.50","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.49","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.48","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.46","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.45","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0331.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13868","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0332.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13869","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2014-0336.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13863","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.26","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.12.21","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2014-0337.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=13867","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15224","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_3.13","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_3.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.13","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.15","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.16","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.17","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.18","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.19","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.20","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.21","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.22","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.23","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.24","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.25","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.26","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.27","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.28","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.29","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.30","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.31","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.32","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2014-4014","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2285-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2286-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2287-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2289-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2336-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2337-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-4014","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0155","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0181","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-0206","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4027","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4171","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4508","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4652","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4653","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4654","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4655","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4656","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-4667","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-5045","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-4014","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T10:00:00Z","modified":"2024-08-06T11:04:28.054Z","updated_at":"2026-11-02T14:33:45.263043Z"}],"euvd":[{"id":"EUVD-2014-3946","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T10:00:00Z","modified":"2024-08-06T11:04:28Z","updated_at":"2026-11-03T01:57:08.409137Z"}],"ghsa":[{"id":"GHSA-73cf-9h72-w34c","title":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that...","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2022-05-14T01:47:40Z","modified":"2025-04-12T12:36:05Z","updated_at":"2026-11-02T15:01:17.900782Z"}],"nvd":[{"id":"CVE-2014-4014","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T11:21:17.793Z","modified":"2026-06-17T00:09:17.823Z","cvss":[{"version":"2.0","score":6.2,"vector":"AV:L/AC:H/Au:N/C:C/I:C/A:C","level":"medium","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:54.464139Z"}],"osv":[{"id":"BELL-CVE-2014-4014","title":"CVE-2014-4014 does not affect BellSoft software","status":"withdrawn","published":"2014-06-23T11:21:00Z","modified":"2026-01-28T07:21:21.420735Z","cvss":[{"version":"2.0","score":6.2,"vector":"AV:L/AC:H/Au:N/C:C/I:C/A:C","level":"medium"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-4014","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T11:21:17Z","modified":"2026-04-16T06:26:14.322121138Z","updated_at":"2026-11-02T15:43:59.654289Z"},{"id":"DEBIAN-CVE-2014-4014","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T11:21:17.793Z","modified":"2026-10-23T15:47:30.722770035Z","updated_at":"2026-11-02T15:45:26.134753Z"},{"id":"MGASA-2014-0273","title":"Updated kernel packages fixes security vulnerabilities","description":"The kernel has been updated to the upstream 3.10.44 longterm kernel,\nand fixes the following security issues:\n\nThe Netlink implementation in the Linux kernel through 3.14.1 does not\nprovide a mechanism for authorizing socket operations based on the\nopener of a socket, which allows local users to bypass intended access\nrestrictions and modify network configurations by using a Netlink socket\nfor the (1) stdout or (2) stderr of a setuid program. (CVE-2014-0181)\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when AUDITSYSCALL\nis enabled with certain syscall rules, allows local users to obtain\npotentially sensitive single-bit values from kernel memory or cause a\ndenial of service (OOPS) via a large value of a syscall number.\n(CVE-2014-3917)\n\nAndy Lutomirski has reported a vulnerability in Linux Kernel, which can\nbe exploited by malicious, local users to gain escalated privileges.\nThe vulnerability is caused due to an error related to checking Inode\ncapabilities, which can be exploited to conduct certain actions with\nescalated privileges.\nSuccessful exploitation requires a kernel built with user namespaces\n(USER_NS) enabled. (CVE-2014-4014)\n\nFor other changes, see the referenced changelogs.\n","status":"published","published":"2014-06-22T21:13:23Z","modified":"2026-04-16T06:25:13.997746543Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0316","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update provides the upstream 3.12.25 longterm kernel and\nfixes the following security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nFor other fixes, see the referenced changelogs and the kernel changelog.\n","status":"published","published":"2014-08-05T20:08:48Z","modified":"2026-04-16T06:26:03.022578055Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0330","title":"Updated kernel-linus package fixes security vulnerabilities","description":"Updated kernel-linus provides upstream 3.10.51 kernel and fixes the\nfollowing security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nThe Netlink implementation in the Linux kernel through 3.14.1 does not\nprovide a mechanism for authorizing socket operations based on the\nopener of a socket, which allows local users to bypass intended access\nrestrictions and modify network configurations by using a Netlink socket\nfor the (1) stdout or (2) stderr of a setuid program. (CVE-2014-0181)\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when AUDITSYSCALL\nis enabled with certain syscall rules, allows local users to obtain\npotentially sensitive single-bit values from kernel memory or cause a\ndenial of service (OOPS) via a large value of a syscall number.\n(CVE-2014-3917)\n\nAndy Lutomirski has reported a vulnerability in Linux Kernel, which can\nbe exploited by malicious, local users to gain escalated privileges.\nThe vulnerability is caused due to an error related to checking Inode\ncapabilities, which can be exploited to conduct certain actions with\nescalated privileges.\nSuccessful exploitation requires a kernel built with user namespaces\n(USER_NS) enabled. (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nFor other fixes, see the referenced changelogs.\n","status":"published","published":"2014-08-18T09:14:56Z","modified":"2026-04-16T06:26:29.886450609Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0331","title":"Updated kernel-tmb package fixes security vulnerabilities","description":"Updated kernel-tmb provides upstream 3.10.51 kernel and fixes the\nfollowing security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nThe Netlink implementation in the Linux kernel through 3.14.1 does not\nprovide a mechanism for authorizing socket operations based on the\nopener of a socket, which allows local users to bypass intended access\nrestrictions and modify network configurations by using a Netlink socket\nfor the (1) stdout or (2) stderr of a setuid program. (CVE-2014-0181)\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when AUDITSYSCALL\nis enabled with certain syscall rules, allows local users to obtain\npotentially sensitive single-bit values from kernel memory or cause a\ndenial of service (OOPS) via a large value of a syscall number.\n(CVE-2014-3917)\n\nAndy Lutomirski has reported a vulnerability in Linux Kernel, which can\nbe exploited by malicious, local users to gain escalated privileges.\nThe vulnerability is caused due to an error related to checking Inode\ncapabilities, which can be exploited to conduct certain actions with\nescalated privileges.\nSuccessful exploitation requires a kernel built with user namespaces\n(USER_NS) enabled. (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nFor other fixes, see the referenced changelogs.\n","status":"published","published":"2014-08-18T09:14:56Z","modified":"2026-04-16T06:22:44.19546842Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0332","title":"Updated kernel-vserver package fixes security vulnerabilities","description":"Updated kernel-vserver provides upstream 3.10.51 kernel and fixes the\nfollowing security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nThe Netlink implementation in the Linux kernel through 3.14.1 does not\nprovide a mechanism for authorizing socket operations based on the\nopener of a socket, which allows local users to bypass intended access\nrestrictions and modify network configurations by using a Netlink socket\nfor the (1) stdout or (2) stderr of a setuid program. (CVE-2014-0181)\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when AUDITSYSCALL\nis enabled with certain syscall rules, allows local users to obtain\npotentially sensitive single-bit values from kernel memory or cause a\ndenial of service (OOPS) via a large value of a syscall number.\n(CVE-2014-3917)\n\nAndy Lutomirski has reported a vulnerability in Linux Kernel, which can\nbe exploited by malicious, local users to gain escalated privileges.\nThe vulnerability is caused due to an error related to checking Inode\ncapabilities, which can be exploited to conduct certain actions with\nescalated privileges.\nSuccessful exploitation requires a kernel built with user namespaces\n(USER_NS) enabled. (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nFor other fixes, see the referenced changelogs.\n","status":"published","published":"2014-08-18T09:14:56Z","modified":"2026-04-16T06:25:37.260325381Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0336","title":"Updated kernel-linus package fixes security vulnerabilities","description":"Updated kernel-linus provides upstream 3.12.26 kernel and fixes the\nfollowing security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when \nCONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local\nusers to obtain potentially sensitive single-bit values from kernel memory\nor cause a denial of service (OOPS) via a large value of a syscall number.\nTo avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.\n(CVE-2014-3917)\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nFor other fixes, see the referenced changelogs.\n","status":"published","published":"2014-08-18T09:14:56Z","modified":"2026-04-16T06:26:02.481419512Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2014-0337","title":"Updated kernel-tmb package fixes security vulnerabilities","description":"Updated kernel-tmb provides upstream 3.12.26 kernel and fixes the\nfollowing security issues:\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when \nCONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local\nusers to obtain potentially sensitive single-bit values from kernel memory\nor cause a denial of service (OOPS) via a large value of a syscall number.\nTo avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.\n(CVE-2014-3917)\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nFor other fixes, see the referenced changelogs.\n","status":"published","published":"2014-08-18T09:14:56Z","modified":"2026-04-16T06:22:31.240544123Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0077","title":"Updated kernel-rt packages fix security vulnerabilities","description":"This kernel-rt update provides as upgrade to upstream 3.14 longterm branch,\ncurrently based on 3.14.32 and fixes the following security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when \nCONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local\nusers to obtain potentially sensitive single-bit values from kernel memory\nor cause a denial of service (OOPS) via a large value of a syscall number.\nTo avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.\n(CVE-2014-3917)\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nThe -rt patch has been updated to -rt28.\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:24:42.918265494Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-4014","description":"The capabilities implementation in the Linux kernel before 3.14.8 does not properly consider that namespaces are inapplicable to inodes, which allows local users to bypass intended chmod restrictions by first creating a user namespace, as demonstrated by setting the setgid bit on a file with group ownership of root.","status":"published","published":"2014-06-23T00:00:00Z","modified":"2026-04-22T09:43:21.665591Z","updated_at":"2026-11-02T15:54:09.010095Z"},{"id":"USN-2337-1","title":"linux vulnerabilities","description":"A flaw was discovered in the Linux kernel virtual machine's (kvm)\nvalidation of interrupt requests (irq). A guest OS user could exploit this\nflaw to cause a denial of service (host OS crash). (CVE-2014-0155)\n\nAndy Lutomirski discovered a flaw in the authorization of netlink socket\noperations when a socket is passed to a process of more privilege. A local\nuser could exploit this flaw to bypass access restrictions by having a\nprivileged executable do something it was not intended to do.\n(CVE-2014-0181)\n\nAn information leak was discovered in the Linux kernels\naio_read_events_ring function. A local user could exploit this flaw to\nobtain potentially sensitive information from kernel memory.\n(CVE-2014-0206)\n\nA flaw was discovered in the Linux kernel's implementation of user\nnamespaces with respect to inode permissions. A local user could exploit\nthis flaw by creating a user namespace to gain administrative privileges.\n(CVE-2014-4014)\n\nAn information leak was discovered in the rd_mcp backend of the iSCSI\ntarget subsystem in the Linux kernel. A local user could exploit this flaw\nto obtain sensitive information from ramdisk_mcp memory by leveraging\naccess to a SCSI initiator. (CVE-2014-4027)\n\nSasha Levin reported an issue with the Linux kernel's shared memory\nsubsystem when used with range notifications and hole punching. A local\nuser could exploit this flaw to cause a denial of service. (CVE-2014-4171)\n\nToralf Förster reported an error in the Linux kernels syscall auditing on\n32 bit x86 platforms. A local user could exploit this flaw to cause a\ndenial of service (OOPS and system crash). (CVE-2014-4508)\n\nAn information leak was discovered in the control implemenation of the\nAdvanced Linux Sound Architecture (ALSA) subsystem in the Linux kernel. A\nlocal user could exploit this flaw to obtain sensitive information from\nkernel memory. (CVE-2014-4652)\n\nA use-after-free flaw was discovered in the Advanced Linux Sound\nArchitecture (ALSA) control implementation of the Linux kernel. A local\nuser could exploit this flaw to cause a denial of service (system crash).\n(CVE-2014-4653)\n\nA authorization bug was discovered with the snd_ctl_elem_add function of\nthe Advanced Linux Sound Architecture (ALSA) in the Linux kernel. A local\nuser could exploit his bug to cause a denial of service (remove kernel\ncontrols). (CVE-2014-4654)\n\nA flaw discovered in how the snd_ctl_elem function of the Advanced Linux\nSound Architecture (ALSA) handled a reference count. A local user could\nexploit this flaw to cause a denial of service (integer overflow and limit\nbypass). (CVE-2014-4655)\n\nAn integer overflow flaw was discovered in the control implementation of\nthe Advanced Linux Sound Architecture (ALSA). A local user could exploit\nthis flaw to cause a denial of service (system crash). (CVE-2014-4656)\n\nAn integer underflow flaw was discovered in the Linux kernel's handling of\nthe backlog value for certain SCTP packets. A remote attacker could exploit\nthis flaw to cause a denial of service (socket outage) via a crafted SCTP\npacket. (CVE-2014-4667)\n\nVasily Averin discover a reference count flaw during attempts to umount in\nconjunction with a symlink. A local user could exploit this flaw to cause a\ndenial of service (memory consumption or use after free) or possibly have\nother unspecified impact. (CVE-2014-5045)\n","status":"published","published":"2014-09-02T18:00:00Z","modified":"2026-04-22T08:58:42.988135Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}