CVE-2014-1444

2014-01-1822:55:03

CWE-399

[email protected]

web.nvd.nist.gov

cve-2014-1444

linux kernel

vulnerability

fst_get_iface

drivers/net/wan/farsync.c

cap_net_admin

siocwandev

ioctl call

CVSS2

1.7

Attack Vector

LOCAL

Attack Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:L/AC:L/Au:S/C:P/I:N/A:N

AI Score

Confidence

High

EPSS

Percentile

5.1%

JSON

The fst_get_iface function in drivers/net/wan/farsync.c in the Linux kernel before 3.11.7 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from kernel memory by leveraging the CAP_NET_ADMIN capability for an SIOCWANDEV ioctl call.

Affected configurations

NVD

Node

linuxlinux_kernelRange≤3.11.6

linuxlinux_kernelMatch3.11

linuxlinux_kernelMatch3.11.1

linuxlinux_kernelMatch3.11.2

linuxlinux_kernelMatch3.11.3

linuxlinux_kernelMatch3.11.4

linuxlinux_kernelMatch3.11.5

VendorProductVersionCPE
linuxlinux_kernel3.11.5cpe:/o:linux:linux_kernel:3.11.5:::
linuxlinux_kernel3.11.2cpe:/o:linux:linux_kernel:3.11.2:::
linuxlinux_kernel3.11.4cpe:/o:linux:linux_kernel:3.11.4:::
linuxlinux_kernelcpe:/o:linux:linux_kernel::::
linuxlinux_kernel3.11cpe:/o:linux:linux_kernel:3.11:::
linuxlinux_kernel3.11.1cpe:/o:linux:linux_kernel:3.11.1:::
linuxlinux_kernel3.11.3cpe:/o:linux:linux_kernel:3.11.3:::

Vendor	Product	Version	CPE
linux	linux_kernel	3.11.5	cpe:/o:linux:linux_kernel:3.11.5:::
linux	linux_kernel	3.11.2	cpe:/o:linux:linux_kernel:3.11.2:::
linux	linux_kernel	3.11.4	cpe:/o:linux:linux_kernel:3.11.4:::
linux	linux_kernel		cpe:/o:linux:linux_kernel::::
linux	linux_kernel	3.11	cpe:/o:linux:linux_kernel:3.11:::
linux	linux_kernel	3.11.1	cpe:/o:linux:linux_kernel:3.11.1:::
linux	linux_kernel	3.11.3	cpe:/o:linux:linux_kernel:3.11.3:::