CVE-2014-4699

Published: 4 July 2014

The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.

From the Ubuntu Security Team

Andy Lutomirski discovered a flaw with the Linux kernel's ptrace syscall on x86_64 processors. An attacker could exploit this flaw to cause a denial of service (System Crash) or potential gain administrative privileges.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels
android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels

begin sha1 is not actual commit that broke it just first kernel (2.6.17)
as reported by Andy Lutomirski
x86_64 only. Likely intel only

Status

References

• https://ubuntu.com/security/notices/USN-2266-1
• https://ubuntu.com/security/notices/USN-2267-1
• https://ubuntu.com/security/notices/USN-2268-1
• https://ubuntu.com/security/notices/USN-2269-1
• https://ubuntu.com/security/notices/USN-2270-1
• https://ubuntu.com/security/notices/USN-2271-1
• https://ubuntu.com/security/notices/USN-2272-1
• https://ubuntu.com/security/notices/USN-2273-1
• https://ubuntu.com/security/notices/USN-2274-1
• https://ubuntu.com/security/notices/USN-2284-1
• https://www.cve.org/CVERecord?id=CVE-2014-4699
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1337339