CVE-2014-4508

Published: 23 June 2014

arch/x86/kernel/entry_32.S in the Linux kernel through 3.15.1 on 32-bit x86 platforms, when syscall auditing is enabled and the sep CPU feature flag is set, allows local users to cause a denial of service (OOPS and system crash) via an invalid syscall number, as demonstrated by number 1000.

From the Ubuntu security team

Toralf Förster reported an error in the Linux kernels syscall auditing on 32 bit x86 platforms. A local user could exploit this flaw to cause a denial of service (OOPS and system crash).

Status

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-4508
• http://article.gmane.org/gmane.linux.kernel/1726110
• http://www.openwall.com/lists/oss-security/2014/06/20/10
• http://openwall.com/lists/oss-security/2014/06/20/1
• https://ubuntu.com/security/notices/USN-2332-1
• https://ubuntu.com/security/notices/USN-2333-1
• https://ubuntu.com/security/notices/USN-2334-1
• https://ubuntu.com/security/notices/USN-2336-1
• https://ubuntu.com/security/notices/USN-2337-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1334989