CVE-2014-9585

Advisory lineage Upstream: 0 Downstream: 15
Modified
Published: 09 Jan 2015, 21:00
Last modified:06 Aug 2024, 13:47

Vulnerability Summary

Overall Risk (default)
low
18/100
CVSS Score
2.1 LOW
v2.0 (nvd)
EPSS Score
0.04% LOW
0% probability 0.00%
KEV
Not listed
Ransomware
No reports
Public exploits
1 found
Dark Web
Not detected

Timeline

09 Jan 2015, 21:00
Published
Vulnerability first disclosed
06 Aug 2024, 13:47
Last Modified
Vulnerability information updated

Description

The vdso_addr function in arch/x86/vdso/vma.c in the Linux kernel through 3.18.2 does not properly choose memory locations for the vDSO area, which makes it easier for local users to bypass the ASLR protection mechanism by guessing a location at the end of a PMD.

CVSS Metrics

  • v2.0•LOW•Score: 2.1AV:L/AC:L/Au:N/C:N/I:P/A:N

EPSS Trends

Current EPSS score: 0.04%• Percentile: 14%

Affected Systems

  • canonical•ubuntu_linux

    12.04 | 14.04 | 14.10

  • debian•debian_linux

    7.0 | 8.0

  • fedoraproject•fedora

    21

  • linux•linux_kernel

    ≤ 3.18.2

  • opensuse•evergreen

    11.4

  • opensuse•opensuse

    13.1

  • redhat•enterprise_linux_aus

    6.6

  • redhat•enterprise_linux_desktop

    6.0 | 7.0

  • redhat•enterprise_linux_eus

    6.6

  • redhat•enterprise_linux_server

    6.0 | 7.0

  • redhat•enterprise_linux_server_aus

    7.3 | 7.4 | 7.6 | 7.7

  • redhat•enterprise_linux_server_eus

    7.1 | 7.2 | 7.3 | 7.4 | 7.5 | 7.6 | 7.7

  • redhat•enterprise_linux_server_tus

    6.6 | 7.3 | 7.6 | 7.7

  • redhat•enterprise_linux_workstation

    6.0 | 7.0

  • suse•linux_enterprise_desktop

    12

  • suse•linux_enterprise_real_time_extension

    11:sp3

  • suse•linux_enterprise_server

    11:sp1 | 11:sp2 | 12

  • suse•linux_enterprise_software_development_kit

    12

  • suse•linux_enterprise_workstation_extension

    12

References (24)