Linux Kernel up to 3.13.6 vhost-net Segmentation net/core/skbuff.c skb_segment resource management
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.8 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Linux Kernel up to 3.13.6. It has been rated as problematic. The affected element is the function skb_segment of the file net/core/skbuff.c of the component vhost-net Segmentation. This manipulation causes resource management.
This vulnerability appears as CVE-2014-0131. There is no available exploit.
Applying a patch is the recommended action to fix this issue.
Details
A vulnerability was found in Linux Kernel up to 3.13.6 (Operating System). It has been declared as problematic. Affected by this vulnerability is the function skb_segment of the file net/core/skbuff.c of the component vhost-net Segmentation. The manipulation with an unknown input leads to a resource management vulnerability. The CWE definition for the vulnerability is CWE-399. As an impact it is known to affect confidentiality. The summary by CVE is:
Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.
The issue has been introduced in 12/03/2009. The weakness was presented 03/10/2014 by Michael S. Tsirkin with Red Hat as [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs as confirmed bugfix (Mailing List). The advisory is shared at marc.info. This vulnerability is known as CVE-2014-0131 since 12/03/2013. The attack needs to approached within the local network. The exploitation doesn't need any form of authentication. Technical details are known, but no exploit is available. The advisory points out:
This fixes a bug in skb_segment where it moves frags between skbs without orphaning them. This causes userspace to assume it's safe to reuse the buffer, and receiver gets corrupted data. This further might leak information from the transmitter on the wire.
The vulnerability was handled as a non-public zero-day exploit for at least 1558 days. During that time the estimated underground price was around $0-$5k. The vulnerability scanner Nessus provides a plugin with the ID 73241 (Fedora 20 : kernel-3.13.7-200.fc20 (2014-4317)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Fedora Local Security Checks. The commercial vulnerability scanner Qualys is able to test this issue with plugin 167699 (SUSE Enterprise Linux Security update for Linux kernel (SUSE-SU-2015:0481-1) - (Deprecated)).
Applying a patch is able to eliminate this problem. The bugfix is ready for download at git.kernel.org. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (92153), Tenable (73241), SecurityFocus (BID 66101†), Secunia (SA57543†) and Vulnerability Center (SBV-43978†). See VDB-10108, VDB-10110, VDB-10114 and VDB-11366 for similar entries. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Vendor
Name
Version
License
Website
- Vendor: https://www.kernel.org/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 3.8
VulDB Base Score: 4.3
VulDB Temp Score: 3.8
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Resource managementCWE: CWE-399 / CWE-404
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Partially
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Nessus ID: 73241
Nessus Name: Fedora 20 : kernel-3.13.7-200.fc20 (2014-4317)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Nessus Port: 🔍
OpenVAS ID: 867638
OpenVAS Name: Fedora Update for kernel FEDORA-2014-4317
OpenVAS File: 🔍
OpenVAS Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: git.kernel.org
Timeline
12/03/2009 🔍12/03/2013 🔍
03/10/2014 🔍
03/10/2014 🔍
03/10/2014 🔍
03/24/2014 🔍
03/28/2014 🔍
03/31/2014 🔍
04/01/2014 🔍
04/09/2014 🔍
06/16/2021 🔍
Sources
Vendor: kernel.orgAdvisory: [PATCH 0/5] skbuff: fix skb_segment with zero copy skbs
Researcher: Michael S. Tsirkin
Organization: Red Hat
Status: Confirmed
Confirmation: 🔍
CVE: CVE-2014-0131 (🔍)
GCVE (CVE): GCVE-0-2014-0131
GCVE (VulDB): GCVE-100-12733
OVAL: 🔍
X-Force: 92153 - Linux Kernel skb_segment information disclosure, Low Risk
SecurityFocus: 66101
Secunia: 57543 - Linux Kernel vhost-net Segmentation Memory Disclosure Security Issue, Less Critical
Vulnerability Center: 43978 - Linux Kernel <=3.13.6 Local Network Information Leakage in Net via Zerocopy, Low
See also: 🔍
Entry
Created: 04/01/2014 11:51Updated: 06/16/2021 11:25
Changes: 04/01/2014 11:51 (87), 05/24/2017 19:29 (3), 06/16/2021 11:25 (3)
Complete: 🔍
Cache ID: 216:733:103
No comments yet. Languages: en.
Please log in to comment.