CVE-2014-8709

Published: 10 November 2014

The ieee80211_fragment function in net/mac80211/tx.c in the Linux kernel before 3.13.5 does not properly maintain a certain tail pointer, which allows remote attackers to obtain sensitive cleartext information by reading packets.

From the Ubuntu security team

Jouni Malinen reported a flaw in the handling of fragmentation in the mac8Linux subsystem of the kernel. A remote attacker could exploit this flaw to obtain potential sensitive cleartext information by reading packets.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-8709
• https://github.com/torvalds/linux/commit/338f977f4eb441e69bb9a46eaa0ac715c931a67f
• http://www.openwall.com/lists/oss-security/2014/11/09/1
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.5
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=338f977f4eb441e69bb9a46eaa0ac715c931a67f
• https://ubuntu.com/security/notices/USN-2441-1
• https://ubuntu.com/security/notices/USN-2442-1
• https://ubuntu.com/security/notices/USN-2175-1
• https://ubuntu.com/security/notices/USN-2177-1
• https://ubuntu.com/security/notices/USN-2221-1
• https://ubuntu.com/security/notices/USN-2227-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1392013