NVD

Id
31391  
Name
CVE-2014-3144  
Description
The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.  
Reject
 
CVSS Version
2  
CVSS Score
4.9  
Severity
Medium  
CVSS Base Score
4.9  
CVSS Impact Subscore
6.9  
CVSS Exploit Subscore
3.9  
CVSS Vector
(AV:L/AC:L/Au:N/C:N/I:N/A:C)  
Pub Date
2017-01-19  
Published
2014-05-11  
Modified Date
2017-01-06  
Seq
2014-3144  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
164338 31391 CVE-2014-3144 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=05ab8f2647e4221cbdb3856dd7d32bd5407316b3  View
164339 31391 CVE-2014-3144 http://linux.oracle.com/errata/ELSA-2014-3052.html  View
164340 31391 CVE-2014-3144 59311  View
164341 31391 CVE-2014-3144 60613  View
164342 31391 CVE-2014-3144 [oss-security] 20140509 Re: CVE request Linux kernel: filter: prevent nla extensions to peek beyond the end of the message  View
164343 31391 CVE-2014-3144 67309  View
164344 31391 CVE-2014-3144 https://github.com/torvalds/linux/commit/05ab8f2647e4221cbdb3856dd7d32bd5407316b3  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
13580 JVNDB-2014-002455 Linux Kernel の net/core/filter.c の sk_run_filter 関数におけるサービス運用妨害 (DoS) の脆弱性 Linux Kernel の net/core/filter.c 内の sk_run_filter 関数の (1) BPF_S_ANC_NLATTR および (2) BPF_S_ANC_NLATTR_NEST 拡張機能の実装は、特定の length 値が十分に大きいかをチェックしないため、サービス運用妨害 (整数アンダーフローおよびシステムクラッシュ) 状態にされる脆弱性が存在します。 CVE-2014-3144 70431 CVE-2014-3144 31391 4.9 http://jvndb.jvn.jp/ja/contents/2014/JVNDB-2014-002455.html 2014-04-14 2014-05-13 View