CVE-2014-8086: linux linux_kernel

Modified

AliasesUBUNTU-CVE-2014-8086DEBIAN-CVE-2014-8086

Published 13-10-2014Last modified 06-08-2024

Vulnerability summary

CVE-2014-8086 is a medium (CVSS 4.7) vulnerability in linux linux_kernel. EPSS estimates a 0.37% chance of exploitation in the next 30 days, higher than 31.4% of scored vulnerabilities. 3 public exploits are recorded.

Priority

Routine

Not severe (CVSS 4.7, local access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.7/10

010

Medium · v3.1 (NVD)

EPSS score

0.37%

0%100%

Low · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits3reference

Advisory lineage

Upstream 0 · Downstream 5 · Related 3

RHSA-2015:0290 RHSA-2015:0694 SUSE-SU-2015:1071-1 SUSE-SU-2015:1478-1 USN-2447-1

Timeline

13-10-2014
PublishedVulnerability first disclosed.
06-08-2024
Last modifiedVulnerability information updated.

Description

Race condition in the ext4_file_write_iter function in fs/ext4/file.c in the Linux kernel through 3.17 allows local users to cause a denial of service (file unavailability) via a combination of a write action and an F_SETFL fcntl operation for the O_DIRECT flag.

CVSS metrics

4 scores · 3 sources · 2 versions

v3.14.7v2.04.7

EPSS trend

Probability

0.37%

Chance of exploitation in the next 30 days

Percentile

31%

Versus all other CVEs

30-day change

No change 0.00 pp

From 0.37% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

3 found

referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown
referenceUnverified
Exploit Reference (spinics.net)
Maturity: unknown
referenceUnverified
Exploit Reference (lkml.org)
Maturity: unknown

Weaknesses

CWE · root cause

CWE-362Concurrent Execution using Shared Resource with Improper SynchronizationThe product contains a concurrent code sequence that requires temporary, exclusive access to a shared resource, but a timing window exists in which the shared resource can be modified by another code sequence operating concurrently.

Affected systems

Version check

Known conditions: local access, low-privilege account, no user interaction (CVSS vector). Other conditions: not stated in public data.

Debian1 product

linux< 3.16.7-ckt2-1

Linux1 product

linux_kernel≤ 3.17

Suse1 product

suse_linux_enterprise_server11:sp2

Ubuntu1 product

linux-lts-utopic< 3.16.0-26.35~14.04.1

4 vendors · 4 products

References

16 links

lkml.org/lkml/2014/10/8/545Mailing ListX Refsource MLISTExploitThird Party Advisory
www.securityfocus.com/bid/70376VDB EntryX Refsource BIDThird Party Advisory
www.spinics.net/lists/linux-ext4/msg45685.htmlMailing ListX Refsource MLISTPatchThird Party Advisory
bugzilla.redhat.com/show_bug.cgi?id=1151353X Refsource CONFIRMIssue TrackingPatchThird Party Advisory
www.spinics.net/lists/linux-ext4/msg45683.htmlMailing ListX Refsource MLISTExploitThird Party AdvisoryREPORT
rhn.redhat.com/errata/RHSA-2015-0694.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
rhn.redhat.com/errata/RHSA-2015-0290.htmlVendor AdvisoryX Refsource REDHATThird Party Advisory
lists.opensuse.org/opensuse-security-announce/2015-09/msg00004.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
exchange.xforce.ibmcloud.com/vulnerabilities/96922VDB EntryX Refsource XFThird Party Advisory
lkml.org/lkml/2014/10/9/129Mailing ListX Refsource MLISTExploitThird Party Advisory

Show all 16 references

www.openwall.com/lists/oss-security/2014/10/09/25Mailing ListX Refsource MLISTThird Party Advisory
ubuntu.com/security/CVE-2014-8086REPORT
ubuntu.com/security/notices/USN-2447-1Advisory
ubuntu.com/security/notices/USN-2448-1Advisory
www.cve.org/CVERecord?id=CVE-2014-8086REPORT
security-tracker.debian.org/tracker/CVE-2014-8086Advisory