CVE-2014-3144 in Linux
Summary
by MITRE
The (1) BPF_S_ANC_NLATTR and (2) BPF_S_ANC_NLATTR_NEST extension implementations in the sk_run_filter function in net/core/filter.c in the Linux kernel through 3.14.3 do not check whether a certain length value is sufficiently large, which allows local users to cause a denial of service (integer underflow and system crash) via crafted BPF instructions. NOTE: the affected code was moved to the __skb_get_nlattr and __skb_get_nlattr_nest functions before the vulnerability was announced.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 06/19/2021
The vulnerability identified as CVE-2014-3144 represents a critical integer underflow flaw in the Linux kernel's packet filtering mechanism that affects versions through 3.14.3. This vulnerability resides within the BPF_S_ANC_NLATTR and BPF_S_ANC_NLATTR_NEST extension implementations, which are part of the socket filter framework designed to provide flexible packet filtering capabilities. The core issue manifests in the sk_run_filter function located in net/core/filter.c, where insufficient validation of length parameters allows malicious actors to manipulate BPF instructions in ways that trigger arithmetic underflow conditions. The vulnerability's impact extends beyond simple denial of service as it can lead to complete system crashes through kernel memory corruption.
The technical exploitation of this vulnerability leverages the absence of proper bounds checking when processing network packet attributes within the kernel's BPF execution environment. When crafted BPF instructions are executed against network packets, the kernel fails to validate that the specified length values are sufficiently large to prevent underflow conditions. This flaw specifically affects the __skb_get_nlattr and __skb_get_nlattr_nest functions that were later moved from their original location to handle the processing of netlink attributes. The integer underflow occurs because the kernel performs arithmetic operations on length values without ensuring they remain within valid ranges, creating a scenario where legitimate packet processing can trigger unexpected kernel behavior. This vulnerability directly corresponds to CWE-191, which describes integer underflow conditions, and demonstrates how improper input validation can lead to system instability.
The operational impact of CVE-2014-3144 is significant for systems utilizing the Linux kernel's BPF functionality, particularly those running network monitoring tools, firewalls, or any application that relies on socket filters for packet processing. Local users with access to the system can exploit this vulnerability to cause system crashes, effectively implementing a denial of service attack against the target machine. The vulnerability's exploitation requires minimal privileges since it operates within the kernel context and can be triggered through legitimate packet processing pathways. Systems that process large volumes of network traffic or employ BPF-based network monitoring solutions face the highest risk of exploitation. The vulnerability's presence in the kernel's core filtering mechanisms means that any application or service that utilizes socket filters for packet inspection could potentially be compromised, making this a widespread concern across various Linux-based systems.
Mitigation strategies for CVE-2014-3144 involve immediate kernel updates to versions that contain the patched implementation of the affected functions. The fix implemented by kernel developers addresses the root cause by introducing proper bounds checking in the length validation routines within the __skb_get_nlattr and __skb_get_nlattr_nest functions. Organizations should prioritize patching systems running Linux kernel versions 3.14.3 and earlier, as these versions remain vulnerable to exploitation. Additionally, implementing network segmentation and access controls can reduce the attack surface by limiting local user access to systems that might be vulnerable. Monitoring for unusual system crashes or denial of service events can help detect potential exploitation attempts, while maintaining updated security patches ensures continued protection against similar vulnerabilities. The vulnerability's classification under ATT&CK technique T1059.007 for kernel-mode rootkits and T1489 for system shutdown/reboot demonstrates its potential for more sophisticated attacks beyond simple denial of service, emphasizing the importance of prompt remediation.