CVE-2014-5045

Advisory lineage Upstream: 0 Downstream: 10
Modified
Published: 01 Aug 2014, 10:00
Last modified:06 Aug 2024, 11:34

Vulnerability Summary

Overall Risk (default)
medium
35/100
CVSS Score
6.2 MEDIUM
v2.0 (nvd)
EPSS Score
0.03% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

01 Aug 2014, 10:00
Published
Vulnerability first disclosed
06 Aug 2024, 11:34
Last Modified
Vulnerability information updated

Description

The mountpoint_last function in fs/namei.c in the Linux kernel before 3.15.8 does not properly maintain a certain reference count during attempts to use the umount system call in conjunction with a symlink, which allows local users to cause a denial of service (memory consumption or use-after-free) or possibly have unspecified other impact via the umount program.

CVSS Metrics

  • v2.0•MEDIUM•Score: 6.2AV:L/AC:H/Au:N/C:C/I:C/A:C

EPSS Trends

Current EPSS score: 0.03%• Percentile: 9%

Techniques & Countermeasures

  • CWE-59•Improper Link Resolution Before File Access ('Link Following')

    The product attempts to access a file based on the filename, but it does not properly prevent that filename from identifying a link or shortcut that resolves to an unintended resource.

Affected Systems

  • linux•linux_kernel

    < 3.15.8

  • redhat•enterprise_linux_eus

    6.5

  • redhat•enterprise_linux_server_aus

    6.5

  • redhat•enterprise_linux_server_tus

    6.5

References (8)