Lucene search

MitreCVE-2014-7284

HistoryOct 13, 2014 - 10:55 a.m.

CVE-2014-7284

2014-10-1310:55:08

CWE-200

mitre

web.nvd.nist.gov

cve-2014-7284

net_get_random_once

linux kernel

intel processors

ip communication

tcp sequence numbers

udp port numbers

ip id values

nvd

security vulnerability

CVSS2

6.4

Attack Vector

NETWORK

Attack Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:L/Au:N/C:N/I:P/A:P

AI Score

Confidence

High

EPSS

0.025

Percentile

90.1%

JSON

The net_get_random_once implementation in net/core/utils.c in the Linux kernel 3.13.x and 3.14.x before 3.14.5 on certain Intel processors does not perform the intended slow-path operation to initialize random seeds, which makes it easier for remote attackers to spoof or disrupt IP communication by leveraging the predictability of TCP sequence numbers, TCP and UDP port numbers, and IP ID values.

Affected configurations

Nvd

Node

linuxlinux_kernelMatch3.13.1

linuxlinux_kernelMatch3.13.2

linuxlinux_kernelMatch3.13.3

linuxlinux_kernelMatch3.13.4

linuxlinux_kernelMatch3.13.5

linuxlinux_kernelMatch3.13.6

linuxlinux_kernelMatch3.13.7

linuxlinux_kernelMatch3.13.8

linuxlinux_kernelMatch3.13.9

linuxlinux_kernelMatch3.13.10

linuxlinux_kernelMatch3.13.11

linuxlinux_kernelMatch3.14.1

linuxlinux_kernelMatch3.14.2

linuxlinux_kernelMatch3.14.3

linuxlinux_kernelMatch3.14.4

VendorProductVersionCPE
linuxlinux_kernel3.13.5cpe:/o:linux:linux_kernel:3.13.5:::
linuxlinux_kernel3.13.7cpe:/o:linux:linux_kernel:3.13.7:::
linuxlinux_kernel3.13.4cpe:/o:linux:linux_kernel:3.13.4:::
linuxlinux_kernel3.14.4cpe:/o:linux:linux_kernel:3.14.4:::
linuxlinux_kernel3.13.3cpe:/o:linux:linux_kernel:3.13.3:::
linuxlinux_kernel3.13.11cpe:/o:linux:linux_kernel:3.13.11:::
linuxlinux_kernel3.14.2cpe:/o:linux:linux_kernel:3.14.2:::
linuxlinux_kernel3.14.3cpe:/o:linux:linux_kernel:3.14.3:::
linuxlinux_kernel3.13.2cpe:/o:linux:linux_kernel:3.13.2:::
linuxlinux_kernel3.14.1cpe:/o:linux:linux_kernel:3.14.1:::

Vendor	Product	Version	CPE
linux	linux_kernel	3.13.5	cpe:/o:linux:linux_kernel:3.13.5:::
linux	linux_kernel	3.13.7	cpe:/o:linux:linux_kernel:3.13.7:::
linux	linux_kernel	3.13.4	cpe:/o:linux:linux_kernel:3.13.4:::
linux	linux_kernel	3.14.4	cpe:/o:linux:linux_kernel:3.14.4:::
linux	linux_kernel	3.13.3	cpe:/o:linux:linux_kernel:3.13.3:::
linux	linux_kernel	3.13.11	cpe:/o:linux:linux_kernel:3.13.11:::
linux	linux_kernel	3.14.2	cpe:/o:linux:linux_kernel:3.14.2:::
linux	linux_kernel	3.14.3	cpe:/o:linux:linux_kernel:3.14.3:::
linux	linux_kernel	3.13.2	cpe:/o:linux:linux_kernel:3.13.2:::
linux	linux_kernel	3.14.1	cpe:/o:linux:linux_kernel:3.14.1:::