CVE-2014-0205: linux linux_kernel

Vulnerability summary

CVE-2014-0205 is a medium (CVSS 6.9) vulnerability in linux linux_kernel. EPSS estimates a 0.66% chance of exploitation in the next 30 days, higher than 51.6% of scored vulnerabilities. 2 public exploits are recorded.

Timeline

1. 28-09-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requeue operations, which allows local users to cause a denial of service (use-after-free and system crash) or possibly gain privileges via a crafted application that triggers a zero count.

• CWE-119Improper Restriction of Operations within the Bounds of a Memory BufferThe product performs operations on a memory buffer, but it reads from or writes to a memory location outside the buffer's intended boundary.