CVE-2014-4699

Published: 04 July 2014

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

From the Ubuntu security team

Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x86_64 processors. An attacker could exploit this flaw to cause a denial of service (System Crash) or potential gain administrative privileges.

Priority

Status

Package	Release	Status
linux Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (4.2.0-16.19)
	Ubuntu 14.04 ESM (Trusty Tahr)	Released (3.13.0-30.55)
	Patches: Introduced by 427abfa28afedffadfca9dd8b067eb6d36bac53f Fixed by b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a
linux-armadaxp Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	This package is not directly supported by the Ubuntu Security Team
linux-ec2 Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-flo Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (3.4.0-3.15)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-fsl-imx51 Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-goldfish Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (3.4.0-4.23)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-grouper Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-linaro-omap Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-linaro-shared Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-linaro-vexpress Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-lts-quantal Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
	Patches: DNE
linux-lts-raring Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-lts-saucy Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-lts-trusty Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-lts-utopic Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was not-affected [3.16.0-25.33~14.04.2])
linux-lts-vivid Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was not-affected [3.19.0-18.18~14.04.1])
linux-maguro Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-mako Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (3.4.0-5.34)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-manta Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (3.4.0-6.29)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist (trusty was ignored)
linux-mvl-dove Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-qcm-msm Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-raspi2 Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Not vulnerable (4.2.0-1014.21)
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist
linux-ti-omap4 Launchpad, Ubuntu, Debian	Upstream	Released (3.16~rc4)




	Ubuntu 16.04 LTS (Xenial Xerus)	Does not exist
	Ubuntu 14.04 ESM (Trusty Tahr)	Does not exist

Notes

Author	Note
jdstrand	android kernels (goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 13.10 preview kernels android kernels (flo, goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 14.04 preview kernels
jj	begin sha1 is not actual commit that broke it just first kernel (2.6.17) as reported by Andy Lutomirski x86_64 only. Likely intel only

References

Bugs

https://launchpad.net/bugs/1337339

Join the discussion

Canonical is offering Extended Security Maintenance

Canonical is offering Ubuntu 14.04 Extended Security Maintenance (ESM) for security fixes and essential packages.

Find out more about ESM