What’s Vulnerable › Vulnerabilities

CVE-2014-0069

• Severity: high (CVSS 7.2 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.4% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2014-02-28 · updated 2026-06-17
• Weakness: CWE-119

Description

The cifs_iovec_write function in fs/cifs/file.c in the Linux kernel through 3.13.5 does not properly handle uncached write operations that copy fewer than the requested number of bytes, which allows local users to obtain sensitive information from kernel memory, cause a denial of service (memory corruption and system crash), or possibly gain privileges via a writev system call with a crafted pointer.

Affected products

• Linux kernel: before 3.2.57; from 3.3 before 3.4.83; from 3.5 before 3.10.33; from 3.11 before 3.12.14; from 3.13 before 3.13.6 — fixed in 3.10.33, 3.12.14, 3.13.6, 3.2.57, 3.4.83
• RedHat Enterprise Linux Desktop: 6.0
• RedHat Enterprise Linux Eus: 6.5
• RedHat Enterprise Linux Server: 6.0
• RedHat Enterprise Linux Server Aus: 6.5
• RedHat Enterprise Linux Server Tus: 6.5
• RedHat Enterprise Linux Workstation: 6.0
• SUSE Linux Enterprise Server 15 SP1: 11-sp3
• SUSE Linux Enterprise Server: 11, 11-sp3

How to fix

Upgrade to a fixed version: Linux kernel 3.10.33, 3.12.14, 3.13.6, 3.2.57. Check the vendor advisory for mitigations.

References

• http://article.gmane.org/gmane.linux.kernel.cifs/9401
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
• http://rhn.redhat.com/errata/RHSA-2014-0328.html
• http://www.openwall.com/lists/oss-security/2014/02/17/4
• http://www.securityfocus.com/bid/65588
• https://bugzilla.redhat.com/show_bug.cgi?id=1064253
• https://github.com/torvalds/linux/commit/5d81de8e8667da7135d3a32a964087c0faf5483f
• http://article.gmane.org/gmane.linux.kernel.cifs/9401
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=5d81de8e8667da7135d3a32a964087c0faf5483f
• http://lists.opensuse.org/opensuse-security-announce/2014-03/msg00026.html
• http://rhn.redhat.com/errata/RHSA-2014-0328.html

Get alerted when CVE-2014-0069 or the next vulnerability affects your stack