{"id":"CVE-2014-9114","aliases":["BELL-CVE-2014-9114","DEBIAN-CVE-2014-9114","EUVD-2014-8940","GHSA-g7m2-8cqp-hf7v","MGASA-2014-0517","SUSE-SU-2015:0270-1","SUSE-SU-2015:0580-1","UBUNTU-CVE-2014-9114","openSUSE-SU-2024:10279-1"],"status":"published","title":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","severity":{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.00642,"percentile":0.51069,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-77"],"published":"2014-06-04T09:10:15Z","modified":"2026-10-23T16:00:17Z","fixes":[{"ecosystem":"Debian:12","package":"util-linux","fixed_in":["2.25.2-4"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"util-linux","fixed_in":["2.25.2-4"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"util-linux","fixed_in":["2.25.2-4"],"sources":["osv"]},{"ecosystem":"Mageia:4","package":"util-linux","fixed_in":["2.24.2-1.mga4"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"python-libmount","fixed_in":["2.25-10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"util-linux","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"util-linux-systemd","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"util-linux","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"python-libmount","fixed_in":["2.25-10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"util-linux","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 12","package":"util-linux-systemd","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"python-libmount","fixed_in":["2.25-10.3"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"util-linux","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"util-linux-systemd","fixed_in":["2.25-10.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"util-linux","fixed_in":["2.25-10.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-4"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-4"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25.2-4"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.24.2-1.mga4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Desktop 12","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 12","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"python-libmount","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.3"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 12","package":"util-linux-systemd","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Workstation Extension 12","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.25-10.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2.20.1-5.1ubuntu9","2.20.1-5.1ubuntu10","2.20.1-5.1ubuntu11","2.20.1-5.1ubuntu12","2.20.1-5.1ubuntu13","2.20.1-5.1ubuntu14","2.20.1-5.1ubuntu15","2.20.1-5.1ubuntu16","2.20.1-5.1ubuntu17","2.20.1-5.1ubuntu18","2.20.1-5.1ubuntu19","2.20.1-5.1ubuntu20","2.20.1-5.1ubuntu20.1","2.20.1-5.1ubuntu20.2","2.20.1-5.1ubuntu20.3","2.20.1-5.1ubuntu20.4","2.20.1-5.1ubuntu20.6","2.20.1-5.1ubuntu20.7","2.20.1-5.1ubuntu20.9"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"util-linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.28.2-2.1"}]}],"bundled":4}],"products":[{"vendor":"fedoraproject","product":"fedora"},{"vendor":"kernel","product":"util-linux"},{"vendor":"opensuse","product":"opensuse"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-December/146229.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/26/21","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Patch","Third Party Advisory","advisory","article","fix"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1168485","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Patch","Third Party Advisory","VDB Entry","advisory","fix","report"]},{"url":"https://github.com/karelzak/util-linux/commit/89e90ae7b2826110ea28c1c0eb8e7c56c3907bdc","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/98993","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-01/msg00035.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.securityfocus.com/bid/71327","tags":["vdb-entry","x_refsource_BID","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"https://security.gentoo.org/glsa/201612-14","tags":["vendor-advisory","x_refsource_GENTOO","x_transferred","Third Party Advisory","VDB Entry","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","advisory"]},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b%40%3Cissues.bookkeeper.apache.org%3E","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9114"},{"url":"https://lists.apache.org/thread.html/r58af02e294bd07f487e2c64ffc0a29b837db5600e33b6e698b9d696b@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://lists.apache.org/thread.html/rf4c02775860db415b4955778a131c2795223f61cb8c6a450893651e4@%3Cissues.bookkeeper.apache.org%3E"},{"url":"https://github.com/advisories/GHSA-g7m2-8cqp-hf7v"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-9114","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9114","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2014-0517.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=14727","tags":["report"]},{"url":"ftp://ftp.kernel.org/pub/linux/utils/util-linux/v2.24/v2.24.1-ReleaseNotes","tags":["web"]},{"url":"ftp://ftp.kernel.org/pub/linux/utils/util-linux/v2.24/v2.24.2-ReleaseNotes","tags":["web"]},{"url":"https://lists.fedoraproject.org/pipermail/package-announce/2014-December/145188.html","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150270-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/907434","tags":["report"]},{"url":"https://bugzilla.suse.com/908742","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2014-9114","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2015/suse-su-20150580-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/761815","tags":["report"]},{"url":"https://bugzilla.suse.com/859062","tags":["report"]},{"url":"https://bugzilla.suse.com/871698","tags":["report"]},{"url":"https://bugzilla.suse.com/888678","tags":["report"]},{"url":"https://bugzilla.suse.com/900965","tags":["report"]},{"url":"https://bugzilla.suse.com/901549","tags":["report"]},{"url":"https://bugzilla.suse.com/917164","tags":["report"]},{"url":"https://bugzilla.suse.com/918041","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9114","tags":["report"]},{"url":"http://www.openwall.com/lists/oss-security/2014/11/26/13","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9114","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2013-0157","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-5218","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2779","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2014-9114","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T15:00:00Z","modified":"2025-12-04T20:21:07.498Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-8940","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T15:00:00Z","modified":"2025-12-04T20:21:07Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T19:49:09.83206Z"}],"ghsa":[{"id":"GHSA-g7m2-8cqp-hf7v","title":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2022-05-13T01:09:06Z","modified":"2025-04-20T03:36:05Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T15:01:44.058341Z"}],"nvd":[{"id":"CVE-2014-9114","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T16:59:00.397Z","modified":"2026-06-17T00:17:46.91Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"secondary"},{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high","assessor":"primary"},{"version":"2.0","score":7.2,"vector":"AV:L/AC:L/Au:N/C:C/I:C/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-77"],"updated_at":"2026-11-02T14:02:58.701118Z"}],"osv":[{"id":"BELL-CVE-2014-9114","title":"CVE-2014-9114 does not affect BellSoft software","status":"withdrawn","published":"2017-03-31T16:59:00Z","modified":"2026-01-26T09:46:02.702265Z","cvss":[{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-9114","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T16:59:00Z","modified":"2026-04-16T06:15:25.174550321Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9114","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T16:59:00.397Z","modified":"2026-10-23T16:00:17.943707957Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"UBUNTU-CVE-2014-9114","description":"Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.","status":"published","published":"2017-03-31T16:59:00Z","modified":"2026-04-22T09:54:54.399985Z","cvss":[{"version":"3.0","score":7.8,"vector":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"},{"version":"3.1","score":7.8,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","level":"high"}],"updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"MGASA-2014-0517","title":"Updated util-linux packages fix CVE-2014-9114","description":"Updated util-linux packages fix security vulnerability:\n\nSebastian Krahmer reported a command injection flaw in blkid. This could\npossibly result in command execution with root privileges (CVE-2014-9114).\n\nThe util-linux package has been updated to version 2.24.2 and patched to\nfix this issue and other bugs.\n","status":"published","published":"2014-12-09T20:12:41Z","modified":"2026-04-16T06:23:38.537857084Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"openSUSE-SU-2024:10279-1","title":"libblkid-devel-2.28.2-2.1 on GA media","description":"These are all security issues fixed in the libblkid-devel-2.28.2-2.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T03:06:55.328362Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"SUSE-SU-2015:0270-1","title":"Security update for util-linux","description":"util-linux was updated to fix one security issue.\n\nThis security issue was fixed:\n- CVE-2014-9114: Using crafted block devices (e.g. USB sticks) it was possibly to inject code via libblkid.\n  libblkid was fixed to care about unsafe chars and possible buffer overflow in cache (bnc#907434)\n\nThis non-security issue was fixed:\n- libblkid: Reset errno in blkid_probe_get_buffer() to prevent\n  failing probes (e. g. for exFAT) (bnc#908742).\n","status":"published","published":"2015-02-10T13:40:36Z","modified":"2026-02-04T02:28:54.496781Z","updated_at":"2026-11-02T15:53:41.276824Z"},{"id":"SUSE-SU-2015:0580-1","title":"Recommended update for util-linux","description":"\nThis update for util-linux provides the following fixes:\n\n    * Make blkid(8) issue only one READ on faulty devices. (bnc#859062)\n    * Added option -r to fsck(8) to dump a few resource statistics after\n      each successful run. (bnc#761815)\n    * Prevent excessive clock drift calculations. (bnc#871698)\n    * Check /etc/adjtime drift factor. (bnc#871698)\n    * Prevent hang in exact hwclock adjustment. (bnc#871698)\n    * Suppress warning that's not relevant on Linux systems. (bnc#871698)\n\n","status":"published","published":"2014-06-04T09:10:15Z","modified":"2026-02-04T03:17:25.395283Z","updated_at":"2026-11-02T15:53:41.276824Z"}]}}