CVE-2014-9585: canonical ubuntu_linux
Vulnerability summary
CVE-2014-9585 is a low (CVSS 2.1) vulnerability in canonical ubuntu_linux. EPSS estimates a 0.56% chance of exploitation in the next 30 days, higher than 46.5% of scored vulnerabilities. 1 public exploit is recorded.
Not severe (CVSS 2.1, local access); no exploitation reported by the 5 checked sources
Source freshness unavailable
How is this decided?Advisory lineage
Upstream 0 · Downstream 13 · Related 2Timeline
- 09-01-2015PublishedVulnerability first disclosed.
- 06-08-2024Last modifiedVulnerability information updated.
Description
The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
0.56%
Chance of exploitation in the next 30 days
Percentile
47%
Versus all other CVEs
30-day change
No change 0.00 pp
From 0.56% on 04-10-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundExploit Reference (openwall.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Known conditions: local access, no authentication (CVSS vector). Other conditions: not stated in public data.
Ubuntu19 products
- linux< 3.13.0-46.75
- linux-azureAll versions (No fix recorded)
- linux-azure-6.11All versions (No fix recorded)
- linux-azure-fdeAll versions (No fix recorded)
- linux-azure-fde-5.15All versions (No fix recorded)
Redhat8 products
- enterprise_linux_aus6.6
- enterprise_linux_desktop6.0 | 7.0
- enterprise_linux_eus6.6
- enterprise_linux_server6.0 | 7.0
- enterprise_linux_server_aus7.3 | 7.4 | 7.6 | 7.7
Suse5 products
Debian2 products
- linux< 3.16.7-ckt4-1
- debian_linuxEOL7.0 | 8.0
Canonical1 product
- ubuntu_linuxEOL12.04 | 14.04 | 14.10
Fedoraproject1 product
- fedoraEOL21
Linux1 product
- linux_kernel≤ 3.18.2
8 vendors · 39 products
References
34 links- git.kernel.orgX Refsource CONFIRM
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-01/msg00035.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- lists.fedoraproject.org/pipermail/package-announce/2015-January/148480.htmlVendor AdvisoryX Refsource FEDORAMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2015/01/09/8Mailing ListX Refsource MLISTThird Party AdvisoryREPORT
Show all 34 references
- lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.mandriva.com/security/advisories?name=MDVSA-2015:058Vendor AdvisoryX Refsource MANDRIVAThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- www.openwall.com/lists/oss-security/2014/12/09/10Mailing ListX Refsource MLISTExploitThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.htmlVendor AdvisoryX Refsource SUSEMailing ListThird Party Advisory
- git.kernel.orgX Refsource MISC