CVE-2014-9529

Published: 9 January 2015

Race condition in the key_gc_unused_keys function in security/keys/gc.c in the Linux kernel through 3.18.2 allows local users to cause a denial of service (memory corruption or panic) or possibly have unspecified other impact via keyctl commands that trigger access to a key structure member during garbage collection of a key.

From the Ubuntu Security Team

A race condition was discovered in the Linux kernel's key ring. A local user could cause a denial of service (memory corruption or panic) or possibly have unspecified impact via the keyctl commands.

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

Status

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9529
• http://marc.info/?l=linux-kernel&m=141986398232547&w=2
• http://marc.info/?l=linux-kernel&m=142047362307894&w=2
• https://ubuntu.com/security/notices/USN-2511-1
• https://ubuntu.com/security/notices/USN-2512-1
• https://ubuntu.com/security/notices/USN-2513-1
• https://ubuntu.com/security/notices/USN-2514-1
• https://ubuntu.com/security/notices/USN-2515-1
• https://ubuntu.com/security/notices/USN-2516-1
• https://ubuntu.com/security/notices/USN-2517-1
• https://ubuntu.com/security/notices/USN-2518-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1409048