Log in Start free

Actively exploited · Published Jun 7, 2014 · Assigned by Chrome

CVE-2014-3153

High 7.8 Exploited

In plain English

A high-severity security flaw in Kernel from Linux. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 37.2% (higher than 99% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit, public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)7.8High
Exploit odds (30 days)37.2%top 1.5% of all CVEs
Exploited in the wildYesCISA KEV since May 25, 2022
Attack tooling2Metasploit, Public PoC

CISA guidance

Apply updates per vendor instructions.

Federal agencies must remediate by Jun 15, 2022.

Official description

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12linux3.14.5-1DEBIAN-CVE-2014-3153
Debian:13linux3.14.5-1DEBIAN-CVE-2014-3153
Debian:14linux3.14.5-1DEBIAN-CVE-2014-3153

Affected products (as reported)

VendorProductVersions
n/a n/a n/a

References