CVE-2014-2851
Description
Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter.
Predictions
Heuristic predictions, AS-IS, for prioritization only.
Mitigations
Mitigation details
CVE-2014-2851 NameCVE-2014-2851 DescriptionInteger overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian…
CVE-2014-2851
| Name | CVE-2014-2851 |
| Description | Integer overflow in the ping_init_sock function in net/ipv4/ping.c in the Linux kernel through 3.14.1 allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that leverages an improperly managed reference counter. |
| Source | CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more) |
| References | DSA-2926-1 |
Vulnerable and fixed packages
The table below lists information on source packages.
| Source Package | Release | Version | Status |
|---|---|---|---|
| linux (PTS) | bullseye | 5.10.223-1 | fixed |
| bullseye (security) | 5.10.257-1 | fixed | |
| bookworm | 6.1.170-3 | fixed | |
| bookworm (security) | 6.1.172-1 | fixed | |
| trixie | 6.12.86-1 | fixed | |
| trixie (security) | 6.12.90-1 | fixed | |
| forky | 7.0.9-1 | fixed | |
| sid | 7.0.10-1 | fixed |
The information below is based on the following data on fixed versions.
| Package | Type | Release | Fixed Version | Urgency | Origin | Debian Bugs |
|---|---|---|---|---|---|---|
| linux | source | wheezy | 3.2.57-3+deb7u1 | DSA-2926-1 | ||
| linux | source | (unstable) | 3.14.4-1 | low | ||
| linux-2.6 | source | (unstable) | (not affected) |
Notes
- linux-2.6 <not-affected> (Introduced in 3.0)
https://lkml.org/lkml/2014/4/10/736
Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac
Apply commands
- linux-2.6 <not-affected> (Introduced in 3.0)https://lkml.org/lkml/2014/4/10/736Upstream commit: https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cacExploits
Public proof-of-concept code below. AS-IS, for defenders and authorised testing only.
Exploit-DB
Linux Kernel - 'group_info' refcounter Overflow Memory Corruption
OS impact
Linux kernel Affected 2 releases
| Version | Status | Fixed in |
|---|---|---|
| 3.0 | Affected | — |
| — | Affected | 3.2.60 |
Debian Mixed 6 releases
| Version | Status | Fixed in |
|---|---|---|
| trixie | Fixed | 3.14.4-1 |
| sid | Fixed | 3.14.4-1 |
| forky | Fixed | 3.14.4-1 |
| bullseye | Fixed | 3.14.4-1 |
| bookworm | Fixed | 3.14.4-1 |
| 7.0 | Affected | — |
References
- http://secunia.com/advisories/59386
- http://secunia.com/advisories/59599
- http://www.debian.org/security/2014/dsa-2926
- http://www.openwall.com/lists/oss-security/2014/04/11/4
- http://www.securityfocus.com/bid/66779
- http://www.securitytracker.com/id/1030769
- https://bugzilla.redhat.com/show_bug.cgi?id=1086730
- https://git.kernel.org/cgit/linux/kernel/git/davem/net.git/commit/?id=b04c46190219a4f845e46a459e3102137b7f6cac
- https://lkml.org/lkml/2014/4/10/736
- https://security-tracker.debian.org/tracker/CVE-2014-2851
CWEs
CWE-416
Community-verified mitigations for this CVE will appear above when contributors publish them.
Verify integrity in audit chain (admin only). AS-IS.