Published: 09/01/2015 Updated: 07/11/2023

CVSS v2 Base Score: 2.1 | Impact Score: 2.9 | Exploitability Score: 3.9

VMScore: 188

Vector: AV:L/AC:L/Au:N/C:N/I:P/A:N

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel up to and including 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.

Vulnerable Product	Search on Vulmon	Subscribe to Product
linux linux kernel
redhat enterprise linux desktop 7.0
redhat enterprise linux workstation 7.0
redhat enterprise linux server 7.0
redhat enterprise linux aus 6.6
redhat enterprise linux server eus 7.2
redhat enterprise linux server eus 7.1
redhat enterprise linux desktop 6.0
redhat enterprise linux server 6.0
redhat enterprise linux workstation 6.0
redhat enterprise linux eus 6.6
redhat enterprise linux server tus 7.3
redhat enterprise linux server aus 7.3
redhat enterprise linux server aus 7.4
redhat enterprise linux server eus 7.3
redhat enterprise linux server eus 7.4
redhat enterprise linux server eus 7.5
redhat enterprise linux server tus 7.6
redhat enterprise linux server eus 7.6
redhat enterprise linux server aus 7.6
redhat enterprise linux server tus 6.6
redhat enterprise linux server eus 7.7
redhat enterprise linux server aus 7.7
redhat enterprise linux server tus 7.7
suse linux enterprise server 11
opensuse evergreen 11.4
suse linux enterprise real time extension 11
suse linux enterprise workstation extension 12
opensuse opensuse 13.1
suse linux enterprise server 12
suse linux enterprise software development kit 12
suse linux enterprise desktop 12
fedoraproject fedora 21
debian debian linux 8.0
debian debian linux 7.0
canonical ubuntu linux 12.04
canonical ubuntu linux 14.10
canonical ubuntu linux 14.04

Debian Bug report logs - #774155 linux: CVE-2014-9428: Remote crash of kernel via batman-adv module Package: linux; Maintainer for linux is Debian Kernel Team <debian-kernel@listsdebianorg>; Reported by: conchur@webde Date: Mon, 29 Dec 2014 16:48:01 UTC Severity: important Tags: patch, security, upstream Found in versi ...

Several vulnerabilities have been discovered in the Linux kernel that may lead to a denial of service, information leaks or privilege escalation CVE-2013-7421 / CVE-2014-9644 It was discovered that the Crypto API allowed unprivileged users to load arbitrary kernel modules A local user can use this flaw to exploit vulnerabilities ...

USN-2516-1 introduced a regression in the Linux kernel ...

Several security issues were fixed in the kernel ...

USN-2516-1 introduced a regression in the Linux kernel ...

Several security issues were fixed in the kernel ...

USN-2515-1 introduced a regression in the Linux kernel ...

Several security issues were fixed in the kernel ...

An information leak flaw was found in the way the Linux kernel's Virtual Dynamic Shared Object (vDSO) implementation performed address randomization A local, unprivileged user could use this flaw to leak kernel memory addresses to user-space ...

NVD-CWE-noinfo http://www.openwall.com/lists/oss-security/2015/01/09/8 http://www.openwall.com/lists/oss-security/2014/12/09/10 http://v0ids3curity.blogspot.in/2014/12/return-to-vdso-using-elf-auxiliary.html http://www.ubuntu.com/usn/USN-2518-1 http://www.ubuntu.com/usn/USN-2515-1 http://www.ubuntu.com/usn/USN-2516-1 http://www.ubuntu.com/usn/USN-2517-1 http://lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.html http://www.ubuntu.com/usn/USN-2514-1 http://www.ubuntu.com/usn/USN-2513-1 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html http://www.debian.org/security/2015/dsa-3170 http://www.mandriva.com/security/advisories?name=MDVSA-2015:058 http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html http://lists.fedoraproject.org/pipermail/package-announce/2015-January/148480.html http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html http://rhn.redhat.com/errata/RHSA-2015-1787.html http://rhn.redhat.com/errata/RHSA-2015-1778.html http://www.securityfocus.com/bid/71990 http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html http://rhn.redhat.com/errata/RHSA-2015-1081.html http://git.kernel.org/?p=linux/kernel/git/tip/tip.git%3Ba=commit%3Bh=fbe1bf140671619508dfa575d74a185ae53c5dbb http://git.kernel.org/?p=linux/kernel/git/luto/linux.git%3Ba=commit%3Bh=bc3b94c31d65e761ddfe150d02932c65971b74e2 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=774155 https://www.debian.org/security/./dsa-3170 https://nvd.nist.gov https://usn.ubuntu.com/2516-3/https://access.redhat.com/security/cve/cve-2014-9585

CVE-2014-9585

Vulnerability Summary

Vulnerability Trend

Vendor Advisories

References

Vulmon Search

About

Products

Connect