Published: 09/07/2014 Updated: 16/02/2024

CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4

VMScore: 696

Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

The Linux kernel prior to 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
debian debian linux 7.0
canonical ubuntu linux 13.10
canonical ubuntu linux 12.04
canonical ubuntu linux 14.04
canonical ubuntu linux 10.04

Andy Lutomirski discovered that the ptrace syscall was not verifying the RIP register to be valid in the ptrace API on x86_64 processors An unprivileged user could use this flaw to crash the kernel (resulting in denial of service) or for privilege escalation For the stable distribution (wheezy), this problem has been fixed in version 3260-1+deb ...

It was found that the Linux kernel's ptrace subsystem allowed a traced process' instruction pointer to be set to a non-canonical memory address without forcing the non-sysret code path when returning to user space A local, unprivileged user could use this flaw to crash the system or, potentially, escalate their privileges on the system Note: The ...

The system could be made to crash or run programs as an administrator ...

Several security issues were fixed in the kernel ...

The system could be made to crash or run programs as an administrator ...

/** * CVE-2014-4699 ptrace/sysret PoC * by Vitaly Nikolenko * vnik@hashcrackorg * * > gcc -O2 poc_v0c * * This code is kernel specific On Ubuntu 12040 LTS (320-23-generic), the * following will trigger the #GP in sysret and overwrite the #PF handler so we * can land to our NOP sled mapped at 0x80000000 * However, once landed, t ...

Linux Kernel ptrace/sysret local privilege escalation proof of concept exploit ...

README for couchbase playground aka, "couchbaselive" aka, "small house couchbase" / "smallcb" Dependencies make docker golang tip: after checking out this project, run "go get /" to download golang dependencies tip: you might need to setup your GOPATH env variables example: GOPATH=/Users/steveyen/go Tip: Denis Ros

My old sysret / ptrace PoC

writeup duasyntcom/blog/cve-2014-4699-linux-kernel-ptrace-sysret-analysis

CWE-362 http://www.openwall.com/lists/oss-security/2014/07/04/4 http://openwall.com/lists/oss-security/2014/07/08/5 http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.4 http://openwall.com/lists/oss-security/2014/07/05/4 https://bugzilla.redhat.com/show_bug.cgi?id=1115927 http://openwall.com/lists/oss-security/2014/07/08/16 https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a http://www.ubuntu.com/usn/USN-2269-1 http://www.ubuntu.com/usn/USN-2268-1 http://www.ubuntu.com/usn/USN-2274-1 http://www.ubuntu.com/usn/USN-2273-1 http://www.ubuntu.com/usn/USN-2272-1 http://www.ubuntu.com/usn/USN-2267-1 http://www.ubuntu.com/usn/USN-2271-1 http://www.debian.org/security/2014/dsa-2972 http://www.ubuntu.com/usn/USN-2266-1 http://www.ubuntu.com/usn/USN-2270-1 https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47 http://secunia.com/advisories/59639 https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11 http://secunia.com/advisories/59633 http://secunia.com/advisories/59654 https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.97 http://linux.oracle.com/errata/ELSA-2014-0924.html http://linux.oracle.com/errata/ELSA-2014-3047.html http://linux.oracle.com/errata/ELSA-2014-3048.html http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html http://www.exploit-db.com/exploits/34134 http://secunia.com/advisories/60393 http://www.osvdb.org/108754 http://secunia.com/advisories/60220 http://secunia.com/advisories/60380 http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a https://nvd.nist.gov https://www.debian.org/security/./dsa-2972 https://github.com/vnik5287/cve-2014-4699-ptrace https://www.exploit-db.com/exploits/34134/https://access.redhat.com/security/cve/cve-2014-4699 https://usn.ubuntu.com/2273-1/

CVE-2014-4699

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

Exploits

Github Repositories

References

Vulmon Search

About

Products

Connect