CVE-2014-0077

Advisory lineage Upstream: 0 Downstream: 17
Modified
Published: 14 Apr 2014, 23:00
Last modified:06 Aug 2024, 09:05

Vulnerability Summary

Overall Risk (default)
low
22/100
CVSS Score
5.5 MEDIUM
v2.0 (nvd)
EPSS Score
0.82% LOW
1% probability +0.65%
KEV
Not listed
Ransomware
No reports
Public exploits
None found
Dark Web
Not detected

Timeline

14 Apr 2014, 23:00
Published
Vulnerability first disclosed
06 Aug 2024, 09:05
Last Modified
Vulnerability information updated

Description

drivers/vhost/net.c in the Linux kernel before 3.13.10, when mergeable buffers are disabled, does not properly validate packet lengths, which allows guest OS users to cause a denial of service (memory corruption and host OS crash) or possibly gain privileges on the host OS via crafted packets, related to the handle_rx and get_rx_bufs functions.

CVSS Metrics

  • v2.0•MEDIUM•Score: 5.5AV:A/AC:H/Au:S/C:P/I:P/A:C

EPSS Trends

Current EPSS score: 0.82%• Percentile: 53%

Techniques & Countermeasures

  • CWE-787•Out-of-bounds Write

    The product writes data past the end, or before the beginning, of the intended buffer.

Affected Systems

  • linux•linux kernel

    < 3.13.10

References (7)