CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
---|---|---|
6.5 | $0-$5k | 0.00 |
A vulnerability, which was classified as critical, was found in Linux Kernel (Operating System) (the affected version is unknown). This affects an unknown code of the component SCTP Server. The manipulation with an unknown input leads to a resource management vulnerability. CWE is classifying the issue as CWE-399. This is going to have an impact on availability.
The weakness was published 11/12/2014 by Liu Wei with Red Hat as Bug 1163087 as confirmed bug report (Bugzilla). The advisory is shared at bugzilla.redhat.com. This vulnerability is uniquely identified as CVE-2014-7841 since 10/03/2014. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Neither technical details nor an exploit are publicly available. The advisory points out:
While the INIT chunk parameter verification dissects through many things in order to detect malformed input, it misses to actually check parameters inside of parameters. E.g. RFC5061, section 4.2.4 proposes a 'set primary IP address' parameter in ASCONF, which has as a subparameter an address parameter. So an attacker may send a parameter type other than SCTP_PARAM_IPV4_ADDRESS or SCTP_PARAM_IPV6_ADDRESS, param_type2af() will subsequently return 0 and thus sctp_get_af_specific() returns NULL, too, which we then happily dereference unconditionally through af->from_addr_param().
The vulnerability scanner Nessus provides a plugin with the ID 81101 (Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3004)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Oracle Linux Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 167678 (SUSE Enterprise Linux Security update for Linux kernel (SUSE-SU-2015:0652-1)).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. The vulnerability will be addressed with the following lines of code:
if (af == NULL) beak;Furthermore it is possible to detect and prevent this kind of attack with TippingPoint and the filter 19367.
The vulnerability is also documented in the databases at X-Force (98659) and Tenable (81101). Similar entries are available at 10840, 12213, 13142 and 67533.
Product
Type
Vendor
Name
License
CPE 2.3
CPE 2.2
CVSSv4
VulDB CVSS-B Score: 🔍VulDB CVSS-BT Score: 🔍
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.5VulDB Meta Temp Score: 6.5
VulDB Base Score: 7.5
VulDB Temp Score: 6.5
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
AV | AC | Au | C | I | A |
---|---|---|---|---|---|
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
---|---|---|---|---|---|
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
ATT&CK: Unknown
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
0-Day | unlock | unlock | unlock | unlock |
---|---|---|---|---|
Today | unlock | unlock | unlock | unlock |
Nessus ID: 81101
Nessus Name: Oracle Linux 5 / 6 : Unbreakable Enterprise kernel (ELSA-2015-3004)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Port: 🔍
OpenVAS ID: 703093
OpenVAS Name: Debian Security Advisory DSA 3093-1 (linux - security update)
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
0-Day Time: 🔍
Patch: e40607cbe270a9e8360907cb1e62ddf0736e4864
TippingPoint: 🔍
McAfee IPS: 🔍
McAfee IPS Version: 🔍
Fortigate IPS: 🔍
Timeline
10/03/2014 🔍11/12/2014 🔍
11/13/2014 🔍
11/13/2014 🔍
11/14/2014 🔍
11/16/2014 🔍
11/29/2014 🔍
01/14/2015 🔍
01/30/2015 🔍
02/24/2022 🔍
Sources
Vendor: kernel.orgAdvisory: Bug 1163087
Researcher: Liu Wei
Organization: Red Hat
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-7841 (🔍)
OVAL: 🔍
X-Force: 98659 - Linux Kernel SCTP denial of service, High Risk
Vulnerability Center: 47074 - Linux Kernel Remote DoS due to a NULL Pointer Deference in the SCTP Server, Medium
SecurityFocus: 71081 - Linux Kernel CVE-2014-7841 SCTP NULL Pointer Dereference Denial of Service Vulnerability
Secunia: 62305 - Ubuntu update for kernel, Moderately Critical
See also: 🔍
Entry
Created: 11/14/2014 12:22Updated: 02/24/2022 20:15
Changes: 11/14/2014 12:22 (86), 06/12/2017 08:12 (5), 02/24/2022 20:07 (4), 02/24/2022 20:15 (1)
Complete: 🔍
No comments yet. Languages: en.
Please log in to comment.