CVE-2014-3153

CVE-2014-3153 is a high-severity (CVSS 7.8) vulnerability in Linux Kernel. CISA added it to the Known Exploited Vulnerabilities catalog on May 25, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 15, 2022. CISA does not currently list it as used in ransomware campaigns. Linux has 32 vulnerabilities in the KEV catalog, 2 of them linked to ransomware.

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

CVSS vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8
• http://linux.oracle.com/errata/ELSA-2014-0771.html
• http://linux.oracle.com/errata/ELSA-2014-3037.html
• http://linux.oracle.com/errata/ELSA-2014-3038.html
• http://linux.oracle.com/errata/ELSA-2014-3039.html
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
• http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html