CVE-2014-0077

Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 14 Apr 2014, 23:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v2.0 (nvd)
EPSS Score
0.17% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Apr 2014, 23:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

CVSS Metrics

  • v2.0•MEDIUM•Score: 5.5AV:A/AC:H/Au:S/C:P/I:P/A:C

EPSS Trends

Current EPSS score: 0.17%• Percentile: 38%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • linux•linux_kernel

    < 3.13.10

References (7)