CVE-2014-0181

Published: 26 April 2014

The Netlink implementation in the Linux kernel through 3.14.1 does not provide a mechanism for authorizing socket operations based on the opener of a socket, which allows local users to bypass intended access restrictions and modify network configurations by using a Netlink socket for the (1) stdout or (2) stderr of a setuid program.

From the Ubuntu Security Team

Andy Lutomirski discovered a flaw in the authorization of netlink socket operations when a socket is passed to a process of more privilege. A local user could exploit this flaw to bypass access restrictions by having a privileged executable do something it was not intended to do.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-0181
• http://marc.info/?l=linux-netdev&m=139828154417533&w=2
• http://marc.info/?l=linux-netdev&m=139820147526004&w=2
• http://marc.info/?l=linux-netdev&m=139820138225967&w=2
• http://www.openwall.com/lists/oss-security/2014/04/23/8
• https://ubuntu.com/security/notices/USN-2336-1
• https://ubuntu.com/security/notices/USN-2337-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1312989