CVE-2014-5077: canonical ubuntu_linux NULL Pointer Dereference

Modified

AliasesRHSA-2014:1668RHSA-2014:1872UBUNTU-CVE-2014-5077+1 more

Published 01-08-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-5077 is a high (CVSS 7.1) NULL Pointer Dereference vulnerability in canonical ubuntu_linux. EPSS estimates a 5.79% chance of exploitation in the next 30 days, higher than 93.1% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 7.1, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

7.1/10

010

High · v2.0 (NVD)

EPSS score

5.79%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 10 · Related 1

DLA-103-1 MGASA-2014-0316 MGASA-2014-0318 MGASA-2014-0336 MGASA-2014-0337 RHSA-2014:1083+4 more

Timeline

01-08-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

The sctp_assoc_update function in net/sctp/associola.c in the Linux kernel through 3.15.8, when SCTP authentication is enabled, allows remote attackers to cause a denial of service (NULL pointer dereference and OOPS) by starting to establish an association between two endpoints immediately after an exchange of INIT and INIT ACK chunks to establish an earlier association between these endpoints in the opposite direction.

CVSS metrics

1 score · 1 source · 1 version

v2.07.1

EPSS trend

Probability

5.79%

Chance of exploitation in the next 30 days

Percentile

93%

Versus all other CVEs

30-day change

No change 0.00 pp

From 5.79% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-476NULL Pointer DereferenceThe product dereferences a pointer that it expects to be valid but is NULL.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Redhat25 products

enterprise_linux_eus6.5
enterprise_linux_server_aus6.2 | 6.5
enterprise_linux_server_tus6.5
kernel< 0:2.6.32-431.37.1.el6 | < 0:2.6.32-358.51.1.el6
kernel-abi-whitelists< 0:2.6.32-431.37.1.el6

Show all 25

Ubuntu18 products

linux< 3.13.0-36.63
linux-azureAll versions (No fix recorded)
linux-azure-6.11All versions (No fix recorded)
linux-azure-fdeAll versions (No fix recorded)
linux-azure-fde-5.15All versions (No fix recorded)

Show all 18

Suse3 products

linux_enterprise_desktop11:sp3
linux_enterprise_real_time_extension11:sp3
linux_enterprise_server11:sp3

Canonical1 product

ubuntu_linuxEOL12.04 | 14.04

Debian1 product

linux< 3.14.15-1

Linux1 product

linux_kernel≥ 2.6.24, < 3.2.63 | ≥ 3.3, < 3.4.103 | ≥ 3.5, < 3.10.53 | ≥ 3.11, < 3.12.27 | ≥ 3.13, < 3.14.17 | ≥ 3.15, < 3.15.10

6 vendors · 49 products

References

39 links

secunia.com/advisories/60545Third Party AdvisoryX Refsource SECUNIA
secunia.com/advisories/62563Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
git.kernel.orgX Refsource CONFIRMVendor Advisory
www.ubuntu.com/usn/USN-2335-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
www.ubuntu.com/usn/USN-2334-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
secunia.com/advisories/60430Third Party AdvisoryX Refsource SECUNIA
lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
secunia.com/advisories/60564Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2014-1083.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory

Show all 39 references

www.openwall.com/lists/oss-security/2014/07/26/1Mailing ListX Refsource MLISTThird Party Advisory
www.ubuntu.com/usn/USN-2359-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
rhn.redhat.com/errata/RHSA-2014-1763.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
secunia.com/advisories/59777Third Party AdvisoryX Refsource SECUNIA
rhn.redhat.com/errata/RHSA-2014-1668.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/95134VDB EntryX Refsource XFThird Party Advisory
www.securitytracker.com/id/1030681VDB EntryX Refsource SECTRACKThird Party Advisory
www.ubuntu.com/usn/USN-2358-1Vendor AdvisoryX Refsource UBUNTUThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1122982X Refsource CONFIRMIssue TrackingPatchThird Party AdvisoryREPORT
github.com/torvalds/linux/commit/1be9a950c646c9092fb3618197f7b6bfb50e82aaX Refsource CONFIRMPatchThird Party Advisory
secunia.com/advisories/60744Third Party AdvisoryX Refsource SECUNIA
www.securityfocus.com/bid/68881VDB EntryX Refsource BIDThird Party Advisory
access.redhat.com/errata/RHSA-2014:1668Advisory
access.redhat.com/security/updates/classification/ARTICLE
access.redhat.com/documentation/…ARTICLE
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1668.jsonAdvisory
access.redhat.com/security/cve/CVE-2014-5077REPORT
www.cve.org/CVERecord?id=CVE-2014-5077AdvisoryREPORT
nvd.nist.gov/vuln/detail/CVE-2014-5077Advisory
access.redhat.com/errata/RHSA-2014:1872Advisory
security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1872.jsonAdvisory
ubuntu.com/security/CVE-2014-5077REPORT
ubuntu.com/security/notices/USN-2332-1Advisory
ubuntu.com/security/notices/USN-2333-1Advisory
ubuntu.com/security/notices/USN-2334-1Advisory
ubuntu.com/security/notices/USN-2335-1Advisory
ubuntu.com/security/notices/USN-2358-1Advisory
ubuntu.com/security/notices/USN-2359-1Advisory
security-tracker.debian.org/tracker/CVE-2014-5077Advisory