Improper input validation in Linux Kernel
CVE-2014-0038
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 6.9 (Medium). Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.355 (98.4th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 98th percentile — 98.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.355 · newest: 0.355 · change: 0.000
Affected products
- Linux Kernel
- openSUSE — versions 12.3
Weakness classification (CWE)
Public proof-of-concept exploits
References
- git.kernel.org/ (VDB Entry, Third Party Advisory)
- www.ubuntu.com/usn/USN-2096-1 (vendor-advisory, Third Party Advisory)
- github.com/saelo/cve-2014-0038 (Third Party Advisory)
- www.ubuntu.com/usn/USN-2095-1 (vendor-advisory, Third Party Advisory)
- pastebin.com/raw.php (Exploit)
- code.google.com/p/chromium/issues/detail (Third Party Advisory)
- www.ubuntu.com/usn/USN-2094-1 (vendor-advisory, Third Party Advisory)
- www.mandriva.com/security/advisories (vendor-advisory, Third Party Advisory)
- secunia.com/advisories/56669 (Not Applicable, third-party-advisory)
- www.securityfocus.com/bid/65255 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2014-0038?
- CVE-2014-0038 is a vulnerability in Linux Kernel, classified under Improper Input Validation. Published 2014-02-06.
- Is CVE-2014-0038 known to be exploited?
- 81 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.