{"id":"CVE-2014-9428","aliases":["BELL-CVE-2014-9428","DEBIAN-CVE-2014-9428","EUVD-2014-9249","GHSA-6332-g6vw-9444","MGASA-2015-0070","MGASA-2015-0075","MGASA-2015-0076","MGASA-2015-0077","MGASA-2015-0078","UBUNTU-CVE-2014-9428","USN-2516-1","USN-2517-1"],"status":"published","title":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N....","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","severity":{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.05361,"percentile":0.92693,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-399"],"published":"2015-01-02T00:00:00Z","modified":"2026-10-23T15:47:25Z","fixes":[{"ecosystem":"Debian:12","package":"linux","fixed_in":["3.16.7-ckt4-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"linux","fixed_in":["3.16.7-ckt4-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"linux","fixed_in":["3.16.7-ckt4-1"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux","fixed_in":["3.13.0-46.75"],"sources":["osv"]},{"ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","fixed_in":["3.16.0-31.41~14.04.1"],"sources":["osv"]}],"affected":[{"source":"osv","ecosystem":"Debian:12","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt4-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt4-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.7-ckt4-1"}]}]},{"source":"osv","ecosystem":"Mageia:4","package":"kernel","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-userspace-headers","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-vboxadditions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.20-5.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-virtualbox","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.3.20-5.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-xtables-addons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.5-11.mga4"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-broadcom-wl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.30.223.141-47.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-fglrx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"14.010.1006-17.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia173","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"173.14.39-31.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia304","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"304.125-3.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kmod-nvidia-current","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"331.113-3.mga4.nonfree"}]}],"bundled":9},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-linus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":19},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-tmb","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-1.mga4"}]}],"bundled":21},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-rt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-0.rt28.1.mga4"}]}],"bundled":29},{"source":"osv","ecosystem":"Mageia:4","package":"kernel-vserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.14.32-0.vs2.3.6.14.1.mga4"}]}],"bundled":21},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-46.75"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-31.41~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.13.0-46.75"}]}],"versions":["3.11.0-12.19","3.12.0-1.3","3.12.0-2.5","3.12.0-2.7","3.12.0-3.8","3.12.0-3.9","3.12.0-4.10","3.12.0-4.12","3.12.0-5.13","3.12.0-7.15","3.13.0-1.16","3.13.0-2.17","3.13.0-3.18","3.13.0-4.19","3.13.0-5.20","3.13.0-6.23","3.13.0-7.25","3.13.0-7.26","3.13.0-8.27","3.13.0-8.28","3.13.0-10.30","3.13.0-11.31","3.13.0-12.32","3.13.0-13.33","3.13.0-14.34","3.13.0-15.35","3.13.0-16.36","3.13.0-17.37","3.13.0-18.38","3.13.0-19.39","3.13.0-19.40","3.13.0-20.42","3.13.0-21.43","3.13.0-22.44","3.13.0-23.45","3.13.0-24.46","3.13.0-24.47","3.13.0-27.50","3.13.0-29.53","3.13.0-30.54","3.13.0-30.55","3.13.0-32.57","3.13.0-33.58","3.13.0-34.60","3.13.0-35.62","3.13.0-36.63","3.13.0-37.64","3.13.0-39.66","3.13.0-40.69","3.13.0-41.70","3.13.0-43.72","3.13.0-44.73","3.13.0-45.74"],"bundled":12},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"linux-lts-utopic","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.16.0-31.41~14.04.1"}]}],"versions":["3.16.0-25.33~14.04.2","3.16.0-26.35~14.04.1","3.16.0-28.37~14.04.1","3.16.0-28.38~14.04.1","3.16.0-29.39~14.04.1","3.16.0-30.40~14.04.1"],"bundled":16}],"products":[{"vendor":"linux","product":"linux_kernel"}],"references":[{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://www.ubuntu.com/usn/USN-2515-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.openwall.com/lists/oss-security/2014/12/31/7","tags":["mailing-list","x_refsource_MLIST","x_transferred","Mailing List","Third Party Advisory","advisory","article","report"]},{"url":"http://www.spinics.net/lists/netdev/msg309425.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5b6698b0e4a37053de35cc24ee695b98a7eb712b","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://github.com/torvalds/linux/commit/5b6698b0e4a37053de35cc24ee695b98a7eb712b","tags":["x_refsource_CONFIRM","x_transferred","Patch","Third Party Advisory","advisory","fix","report"]},{"url":"http://www.ubuntu.com/usn/USN-2518-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.mandriva.com/security/advisories?name=MDVSA-2015:058","tags":["vendor-advisory","x_refsource_MANDRIVA","x_transferred","Broken Link","advisory"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Mailing List","Third Party Advisory","advisory","article"]},{"url":"http://bugs.debian.org/774155","tags":["x_refsource_CONFIRM","x_transferred","Third Party Advisory","advisory","report"]},{"url":"https://lists.open-mesh.org/pipermail/b.a.t.m.a.n/2014-November/012561.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Third Party Advisory","advisory","report"]},{"url":"http://www.ubuntu.com/usn/USN-2517-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"http://www.ubuntu.com/usn/USN-2516-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2014-9428"},{"url":"http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=5b6698b0e4a37053de35cc24ee695b98a7eb712b","tags":["report"]},{"url":"https://github.com/advisories/GHSA-6332-g6vw-9444"},{"url":"https://docs.bell-sw.com/security/cves/CVE-2014-9428","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2014-9428","tags":["advisory"]},{"url":"https://advisories.mageia.org/MGASA-2015-0070.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15221","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.28","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.29","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.30","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.31","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.32","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0075.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15222","tags":["report"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.24","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.25","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.26","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.27","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0076.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15223","tags":["report"]},{"url":"https://advisories.mageia.org/MGASA-2015-0077.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15224","tags":["report"]},{"url":"http://kernelnewbies.org/Linux_3.13","tags":["web"]},{"url":"http://kernelnewbies.org/Linux_3.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.1","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.2","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.3","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.4","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.5","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.6","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.7","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.8","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.9","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.10","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.12","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.13","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.14","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.15","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.16","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.17","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.18","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.19","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.20","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.21","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.22","tags":["web"]},{"url":"https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.23","tags":["web"]},{"url":"https://advisories.mageia.org/MGASA-2015-0078.html","tags":["advisory"]},{"url":"https://bugs.mageia.org/show_bug.cgi?id=15225","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9428","tags":["report"]},{"url":"http://thread.gmane.org/gmane.linux.network/343494","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-2515-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2516-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2517-1","tags":["advisory"]},{"url":"https://ubuntu.com/security/notices/USN-2518-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2014-9428","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8133","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8160","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8559","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-8989","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9419","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9420","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9529","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9584","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9585","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9683","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2015-0239","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9728","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9729","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9730","tags":["report"]},{"url":"https://ubuntu.com/security/CVE-2014-9731","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2014-9428","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T21:00:00Z","modified":"2024-08-06T13:47:40.368Z","updated_at":"2026-11-02T14:33:42.54191Z"}],"euvd":[{"id":"EUVD-2014-9249","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T21:00:00Z","modified":"2024-08-06T13:47:40Z","updated_at":"2026-11-03T01:56:49.310799Z"}],"ghsa":[{"id":"GHSA-6332-g6vw-9444","title":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N....","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2022-05-17T04:13:50Z","modified":"2025-04-12T12:44:47Z","updated_at":"2026-11-02T15:01:20.346559Z"}],"nvd":[{"id":"CVE-2014-9428","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T21:59:00.063Z","modified":"2026-06-17T00:18:21.083Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high","assessor":"primary"}],"cwes":["CWE-399"],"updated_at":"2026-11-02T14:02:58.030217Z"}],"osv":[{"id":"BELL-CVE-2014-9428","title":"CVE-2014-9428 does not affect BellSoft software","status":"withdrawn","published":"2015-01-02T21:59:00Z","modified":"2026-01-28T07:21:32.915629Z","cvss":[{"version":"2.0","score":7.8,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:C","level":"high"}],"updated_at":"2026-11-02T15:28:13.47097Z"},{"id":"CVE-2014-9428","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T21:59:00Z","modified":"2026-04-16T06:22:45.197685751Z","updated_at":"2026-11-02T15:44:00.097545Z"},{"id":"DEBIAN-CVE-2014-9428","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T21:59:00.063Z","modified":"2026-10-23T15:47:25.133256066Z","updated_at":"2026-11-02T15:45:26.442161Z"},{"id":"MGASA-2015-0070","title":"Updated kernel packages fix security vulnerabilities","description":"This kernel update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggerinf a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-17T18:38:13Z","modified":"2026-04-16T06:25:01.110931073Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0075","title":"Updated kernel-linus packages fix security vulnerabilities","description":"This kernel-linus update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:22:37.183786675Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0076","title":"Updated kernel-tmb packages fix security vulnerabilities","description":"This kernel-tmb update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:25:04.464521306Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0077","title":"Updated kernel-rt packages fix security vulnerabilities","description":"This kernel-rt update provides as upgrade to upstream 3.14 longterm branch,\ncurrently based on 3.14.32 and fixes the following security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nArray index error in the aio_read_events_ring function in fs/aio.c in\nthe Linux kernel through 3.15.1 allows local users to obtain sensitive\ninformation from kernel memory via a large head value (CVE-2014-0206).\n\nmedia-device: fix infoleak in ioctl media_enum_entities()\n(CVE-2014-1739)\n\nThe futex_requeue function in kernel/futex.c in the Linux kernel through\n3.14.5 does not ensure that calls have two different futex addresses,\nwhich allows local users to gain privileges via a crafted FUTEX_REQUEUE\ncommand that facilitates unsafe waiter modification. (CVE-2014-3153)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nkernel/auditsc.c in the Linux kernel through 3.14.5, when \nCONFIG_AUDITSYSCALL is enabled with certain syscall rules, allows local\nusers to obtain potentially sensitive single-bit values from kernel memory\nor cause a denial of service (OOPS) via a large value of a syscall number.\nTo avoid this and other issues CONFIG_AUDITSYSCALL has been disabled.\n(CVE-2014-3917)\n\nThe capabilities implementation in the Linux kernel before 3.14.8 does\nnot properly consider that namespaces are inapplicable to inodes, which\nallows local users to bypass intended chmod restrictions by first creating\na user namespace, as demonstrated by setting the setgid bit on a file with\ngroup ownership of root (CVE-2014-4014)\n\nmm/shmem.c in the Linux kernel through 3.15.1 does not properly implement\nthe interaction between range notification and hole punching, which allows\nlocal users to cause a denial of service (i_mutex hold) by using the mmap\nsystem call to access a hole, as demonstrated by interfering with intended\nshmem activity by blocking completion of (1) an MADV_REMOVE madvise call\nor (2) an FALLOC_FL_PUNCH_HOLE fallocate call (CVE-2014-4171).\n\narch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit\nx86 platforms, when syscall auditing is enabled and the sep CPU feature\nflag is set, allows local users to cause a denial of service (OOPS and\nsystem crash) via an invalid syscall number, as demonstrated by number\n1000 (CVE-2014-4508). \n\nA flaw was found in the way reference counting was handled in the Linux\nkernels VFS subsystem when unmount on symlink was performed. An unprivileged\nlocal user could use this flaw to cause OOM conditions leading to denial\nof service or, potentially, trigger use-after-free error (CVE-2014-5045).\n\nLinux kernel built with the support for Stream Control Transmission Protocol\n(CONFIG_IP_SCTP) is vulnerable to a NULL pointer dereference flaw. It could\noccur when simultaneous new connections are initiated between the same pair\nof hosts. A remote user/program could use this flaw to crash the system\nkernel resulting in DoS (CVE.2014-5077).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nThe -rt patch has been updated to -rt28.\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:24:42.918265494Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"MGASA-2015-0078","title":"Updated kernel-vserver packages fix security vulnerabilities","description":"This kernel-vserver update is based on upstream -longterm 3.14.32 and fixes the \nfollowing security issues:\n\nThe microcode on AMD 16h 00h through 0Fh processors does not properly handle\nthe interaction between locked instructions and write-combined memory types,\nwhich allows local users to cause a denial of service (system hang) via a\ncrafted application, aka the errata 793 issue (CVE-2013-6885)\n\nThe kvm_iommu_map_pages function in virt/kvm/iommu.c in the Linux kernel\nthrough 3.16.1 miscalculates the number of pages during the handling of\na mapping failure, which allows guest OS users to (1) cause a denial of\nservice (host OS memory corruption) or possibly have unspecified other\nimpact by triggering a large gfn value or (2) cause a denial of service\n(host OS memory consumption) by triggering a small gfn value that leads\nto permanently pinned pages (CVE-2014-3601).\n\nThe WRMSR processing functionality in the KVM subsystem in the Linux\nkernel through 3.17.2 does not properly handle the writing of a non-\ncanonical address to a model-specific register, which allows guest OS\nusers to cause a denial of service (host OS crash) by leveraging guest\nOS privileges, related to the wrmsr_interception function in\narch/x86/kvm/svm.c and the handle_wrmsr function in arch/x86/kvm/vmx.c\n(CVE-2014-3610).\n\nRace condition in the __kvm_migrate_pit_timer function in\narch/x86/kvm/i8254.c in the KVM subsystem in the Linux kernel through\n3.17.2 allows guest OS users to cause a denial of service (host OS crash)\nby leveraging incorrect PIT emulation (CVE-2014-3611).\n\narch/x86/kvm/vmx.c in the KVM subsystem in the Linux kernel through 3.17.2\ndoes not have an exit handler for the INVVPID instruction, which allows\nguest OS users to cause a denial of service (guest OS crash) via a crafted\napplication (CVE-2014-3646).\n\narch/x86/kvm/emulate.c in the KVM subsystem in the Linux kernel through\n3.17.2 does not properly perform RIP changes, which allows guest OS users\nto cause a denial of service (guest OS crash) via a crafted application\n(CVE-2014-3647).\n\nThe pivot_root implementation in fs/namespace.c in the Linux kernel through\n3.17 does not properly interact with certain locations of a chroot directory,\nwhich allows local users to cause a denial of service (mount-tree loop) via\n. (dot) values in both arguments to the pivot_root system call\n(CVE-2014-7970).\n\narch/x86/kernel/tls.c in the Thread Local Storage (TLS) implementation in\nthe Linux kernel through 3.18.1 allows local users to bypass the espfix\nprotection mechanism, and consequently makes it easier for local users to\nbypass the ASLR protection mechanism, via a crafted application that makes\na set_thread_area system call and later reads a 16-bit value (CVE-2014-8133).\n\nThe paravirt_ops_setup function in arch/x86/kernel/kvm.c in the Linux kernel\nthrough 3.18 uses an improper paravirt_enabled setting for KVM guest kernels,\nwhich makes it easier for guest OS users to bypass the ASLR protection\nmechanism via a crafted application that reads a 16-bit value (CVE-2014-8134).\n\nThe Linux kernel through 3.17.4 does not properly restrict dropping of\nsupplemental group memberships in certain namespace scenarios, which allows\nlocal users to bypass intended file permissions by leveraging a POSIX ACL\ncontaining an entry for the group category that is more restrictive than\nthe entry for the other category, aka a \"negative groups\" issue, related to\nkernel/groups.c, kernel/uid16.c, and kernel/user_namespace.c (CVE-2014-8989).\n\narch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly\nhandle faults associated with the Stack Segment (SS) segment register, which\n allows local users to gain privileges by triggering an IRET instruction that\nleads to access to a GS Base address from the wrong space (CVE-2014-9322).\n\nOn x86_64 Linux kernels a malicious user program can do a partial ASLR\nbypass through TLS base addresses leak when attacking other programs\n(CVE-2014-9419).\n\nLinux kernel built with the iso9660 file system (CONFIG_ISO9660_FS) support\nis vulnerable to an infinite recursion loop flaw, which could lead to a\ncrash or render a system unresponsive/unusable after a while. This occurs\nwhile mounting an iso9660 image. An unprivileged user/process could use\nthis flaw to crash the system resulting in DoS (CVE-2014-9420).\n\nThe batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in\nthe B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an\nincorrect length field during a calculation of an amount of memory, which\nallows remote attackers to cause a denial of service (mesh-node system crash)\nvia fragmented packets (CVE-2014-9428).\n\nRace condition in the key_gc_unused_keys function in security/keys/gc.c\nin the Linux kernel through 3.18.2 allows local users to cause a denial\nof service (memory corruption or panic) or possibly have unspecified other\nimpact via keyctl commands that trigger access to a key structure member\nduring garbage collection of a key (CVE-2014-9529).\n\nThe parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux\nkernel before 3.18.2 does not validate a length value in the Extensions\nReference (ER) System Use Field, which allows local users to obtain sensitive\ninformation from kernel memory via a crafted iso9660 image (CVE-2014-9584).\n\nThe vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through\n3.18.2 does not properly choose memory locations for the vDSO area, which\nmakes it easier for local users to bypass the ASLR protection mechanism by\nguessing a location at the end of a PMD (CVE-2014-9585).\n\nLinux Kernel 2.6.38 through 3.18 are affected by a flaw in the Crypto API\nthat allows any local user to load any installed kernel module on systems\nwhere CONFIG_CRYPTO_USER_API=y by abusing the request_module() call\n(CVE-2013-7421, CVE-2014-9644).\n\nWhen hitting an sctp INIT collision case during the 4WHS with AUTH enabled,\nit can create a local denial of service by triggering a panic on server side\n(CVE-2015-1421).\n\nIt was found that routing packets to too many different dsts/too fast can\nlead to a excessive resource consumption. A remote attacker can use this\nflaw to crash the system (CVE-2015-1465).\n\nThe vserver patch has been updated to vs2.3.6.14\n\nFor other fixes in this update, see the referenced changelogs.\n","status":"published","published":"2015-02-19T14:43:07Z","modified":"2026-04-16T06:22:23.721995927Z","updated_at":"2026-11-02T15:49:39.488462Z"},{"id":"UBUNTU-CVE-2014-9428","description":"The batadv_frag_merge_packets function in net/batman-adv/fragmentation.c in the B.A.T.M.A.N. implementation in the Linux kernel through 3.18.1 uses an incorrect length field during a calculation of an amount of memory, which allows remote attackers to cause a denial of service (mesh-node system crash) via fragmented packets.","status":"published","published":"2015-01-02T00:00:00Z","modified":"2026-04-22T09:55:26.96961Z","updated_at":"2026-11-02T15:54:09.378953Z"},{"id":"USN-2516-1","title":"linux vulnerabilities","description":"A flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of\nthe SYSTENTER instruction when the guest OS does not initialize the\nSYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of\nservice of the guest OS (crash) or potentially gain privileges on the guest\nOS. (CVE-2015-0239)\n\nAndy Lutomirski discovered an information leak in the Linux kernel's Thread\nLocal Storage (TLS) implementation allowing users to bypass the espfix to\nobtain information that could be used to bypass the Address Space Layout\nRandomization (ASLR) protection mechanism. A local user could exploit this\nflaw to obtain potentially sensitive information from kernel memory.\n(CVE-2014-8133)\n\nA restriction bypass was discovered in iptables when conntrack rules are\nspecified and the conntrack protocol handler module is not loaded into the\nLinux kernel. This flaw can cause the firewall rules on the system to be\nbypassed when conntrack rules are used. (CVE-2014-8160)\n\nA flaw was discovered with file renaming in the linux kernel. A local user\ncould exploit this flaw to cause a denial of service (deadlock and system\nhang). (CVE-2014-8559)\n\nA flaw was discovered in how supplemental group memberships are handled in\ncertain namespace scenarios. A local user could exploit this flaw to bypass\nfile permission restrictions. (CVE-2014-8989)\n\nA flaw was discovered in how Thread Local Storage (TLS) is handled by the\ntask switching function in the Linux kernel for x86_64 based machines. A\nlocal user could exploit this flaw to bypass the Address Space Layout\nRadomization (ASLR) protection mechanism. (CVE-2014-9419)\n\nPrasad J Pandit reported a flaw in the rock_continue function of the Linux\nkernel's ISO 9660 CDROM file system. A local user could exploit this flaw\nto cause a denial of service (system crash or hang). (CVE-2014-9420)\n\nA flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced\nMeshing Protocol in the Linux kernel. A remote attacker could exploit this\nflaw to cause a denial of service (mesh-node system crash) via fragmented\npackets. (CVE-2014-9428)\n\nA race condition was discovered in the Linux kernel's key ring. A local\nuser could cause a denial of service (memory corruption or panic) or\npossibly have unspecified impact via the keyctl commands. (CVE-2014-9529)\n\nA memory leak was discovered in the ISO 9660 CDROM file system when parsing\nrock ridge ER records. A local user could exploit this flaw to obtain\nsensitive information from kernel memory via a crafted iso9660 image.\n(CVE-2014-9584)\n\nA flaw was discovered in the Address Space Layout Randomization (ASLR) of\nthe Virtual Dynamically linked Shared Objects (vDSO) location. This flaw\nmakes it easier for a local user to bypass the ASLR protection mechanism.\n(CVE-2014-9585)\n\nDmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file\nname decoding. A local unprivileged user could exploit this flaw to cause a\ndenial of service (system crash) or potentially gain administrative\nprivileges. (CVE-2014-9683)\n","status":"published","published":"2015-02-26T11:22:06Z","modified":"2026-04-22T09:08:41.845875Z","updated_at":"2026-11-02T16:58:09.227524Z"},{"id":"USN-2517-1","title":"linux-lts-utopic vulnerabilities","description":"\nA flaw was discovered in the Kernel Virtual Machine's (KVM) emulation of\nthe SYSTENTER instruction when the guest OS does not initialize the\nSYSENTER MSRs. A guest OS user could exploit this flaw to cause a denial of\nservice of the guest OS (crash) or potentially gain privileges on the guest\nOS. (CVE-2015-0239)\n\nAndy Lutomirski discovered an information leak in the Linux kernel's Thread\nLocal Storage (TLS) implementation allowing users to bypass the espfix to\nobtain information that could be used to bypass the Address Space Layout\nRandomization (ASLR) protection mechanism. A local user could exploit this\nflaw to obtain potentially sensitive information from kernel memory.\n(CVE-2014-8133)\n\nA restriction bypass was discovered in iptables when conntrack rules are\nspecified and the conntrack protocol handler module is not loaded into the\nLinux kernel. This flaw can cause the firewall rules on the system to be\nbypassed when conntrack rules are used. (CVE-2014-8160)\n\nA flaw was discovered with file renaming in the linux kernel. A local user\ncould exploit this flaw to cause a denial of service (deadlock and system\nhang). (CVE-2014-8559)\n\nA flaw was discovered in how supplemental group memberships are handled in\ncertain namespace scenarios. A local user could exploit this flaw to bypass\nfile permission restrictions. (CVE-2014-8989)\n\nA flaw was discovered in how Thread Local Storage (TLS) is handled by the\ntask switching function in the Linux kernel for x86_64 based machines. A\nlocal user could exploit this flaw to bypass the Address Space Layout\nRadomization (ASLR) protection mechanism. (CVE-2014-9419)\n\nPrasad J Pandit reported a flaw in the rock_continue function of the Linux\nkernel's ISO 9660 CDROM file system. A local user could exploit this flaw\nto cause a denial of service (system crash or hang). (CVE-2014-9420)\n\nA flaw was discovered in the fragment handling of the B.A.T.M.A.N. Advanced\nMeshing Protocol in the Linux kernel. A remote attacker could exploit this\nflaw to cause a denial of service (mesh-node system crash) via fragmented\npackets. (CVE-2014-9428)\n\nA race condition was discovered in the Linux kernel's key ring. A local\nuser could cause a denial of service (memory corruption or panic) or\npossibly have unspecified impact via the keyctl commands. (CVE-2014-9529)\n\nA memory leak was discovered in the ISO 9660 CDROM file system when parsing\nrock ridge ER records. A local user could exploit this flaw to obtain\nsensitive information from kernel memory via a crafted iso9660 image.\n(CVE-2014-9584)\n\nA flaw was discovered in the Address Space Layout Randomization (ASLR) of\nthe Virtual Dynamically linked Shared Objects (vDSO) location. This flaw\nmakes it easier for a local user to bypass the ASLR protection mechanism.\n(CVE-2014-9585)\n\nDmitry Chernenkov discovered a buffer overflow in eCryptfs' encrypted file\nname decoding. A local unprivileged user could exploit this flaw to cause a\ndenial of service (system crash) or potentially gain administrative\nprivileges. (CVE-2014-9683)\n\nCarl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) failed to\nverify symlink size info. A local attacker, who is able to mount a malicous\nUDF file system image, could exploit this flaw to cause a denial of service\n(system crash) or possibly cause other undesired behaviors. (CVE-2014-9728)\n\nCarl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not\nvalid inode size information . A local attacker, who is able to mount a\nmalicous UDF file system image, could exploit this flaw to cause a denial\nof service (system crash) or possibly cause other undesired behaviors.\n(CVE-2014-9729)\n\nCarl H Lunde discovered that the UDF file system (CONFIG_UDF_FS) did not\ncorrectly verify the component length for symlinks. A local attacker, who\nis able to mount a malicous UDF file system image, could exploit this flaw\nto cause a denial of service (system crash) or possibly cause other\nundesired behaviors. (CVE-2014-9730)\n\nCarl H Lunde discovered an information leak in the UDF file system\n(CONFIG_UDF_FS). A local attacker, who is able to mount a malicous UDF file\nsystem image, could exploit this flaw to read potential sensitve kernel\nmemory. (CVE-2014-9731)\n","status":"published","published":"2015-02-26T11:28:20Z","modified":"2026-02-10T04:40:53Z","updated_at":"2026-11-02T16:58:09.227524Z"}]}}