What’s Vulnerable › Vulnerabilities
CVE-2014-3153: Linux Kernel Privilege Escalation Vulnerability
- Severity: high (CVSS 7.8 v3.1)
- Exploited in the wild: yes — in CISA KEV since 2022-05-25
- EPSS: 37.2% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2014-06-07 · updated 2026-06-17
Description
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
Affected products
- Canonical Ubuntu Linux: 12.04, 14.04
- Linux kernel: before 3.2.60; from 3.3 before 3.4.92; from 3.5 before 3.10.42; from 3.11 before 3.12.22; from 3.13 before 3.14.6 — fixed in 3.10.42, 3.12.22, 3.14.6, 3.2.60, 3.4.92
- Opensuse: 11.4
- Oracle Corporation Oracle Linux: 5, 6
- RedHat Enterprise Linux Server Aus: 6.2
- SUSE Linux Enterprise Server 15 SP1: 11-sp3
- SUSE Linux Enterprise High Availability Extension: 11-sp3
- SUSE Linux Enterprise Real Time Extension: 11-sp3
- SUSE Linux Enterprise Server: 11, 11-sp2, 11-sp3
How to fix
Upgrade to a fixed version: Linux kernel 3.10.42, 3.12.22, 3.14.6, 3.2.60. Check the vendor advisory for mitigations.
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8
- http://linux.oracle.com/errata/ELSA-2014-0771.html
- http://linux.oracle.com/errata/ELSA-2014-3037.html
- http://linux.oracle.com/errata/ELSA-2014-3038.html
- http://linux.oracle.com/errata/ELSA-2014-3039.html
- http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
- http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
- http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
- http://openwall.com/lists/oss-security/2014/06/05/24
Get alerted when CVE-2014-3153 or the next vulnerability affects your stack