CVE-2014-9644

Published: 31 December 2014

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

From the Ubuntu security team

A flaw was discovered in the crypto subsystem when screening module names for automatic module loading if the name contained a valid crypto module name, eg. vfat(aes). A local user could exploit this flaw to load installed kernel modules, increasing the attack surface and potentially using this to gain administrative privileges.

Status

Notes

android kernels (flo, goldfish, grouper, maguro, mako and manta) are
not supported on the Ubuntu Touch 14.04 preview kernels
linux-lts-saucy no longer receives official support
linux-lts-quantal no longer receives official support

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-9644
• https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=4943ba16bbc2 (v3.19-rc1)
• https://ubuntu.com/security/notices/USN-2513-1
• https://ubuntu.com/security/notices/USN-2514-1
• https://ubuntu.com/security/notices/USN-2543-1
• https://ubuntu.com/security/notices/USN-2544-1
• https://ubuntu.com/security/notices/USN-2545-1
• https://ubuntu.com/security/notices/USN-2546-1
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1415632