What’s Vulnerable › Vulnerabilities
CVE-2014-4943
- Severity: medium (CVSS 6.9 v2.0)
- Exploited in the wild: not listed in CISA KEV
- EPSS: 2.1% probability of exploitation in the next 30 days
- Public exploit or detection template: yes
- Published: 2014-07-19 · updated 2026-06-17
- Weakness: CWE-269
Description
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
Affected products
- Debian Linux: 7.0
- Linux kernel: from 2.6.23 before 3.2.62; from 3.3 before 3.4.102; from 3.5 before 3.10.52; from 3.11 before 3.12.27; from 3.13 before 3.14.16; from 3.15 before 3.15.9 — fixed in 3.10.52, 3.12.27, 3.14.16, 3.15.9, 3.2.62, 3.4.102
- Opensuse: 11.4
- RedHat Enterprise Linux Server Aus: 6.2
- SUSE Linux Enterprise Server 15 SP1: 11-sp3
- SUSE Linux Enterprise Server: 11-sp2, 11-sp3
How to fix
Upgrade to a fixed version: Linux kernel 3.10.52, 3.12.27, 3.14.16, 3.15.9. Check the vendor advisory for mitigations.
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
- http://linux.oracle.com/errata/ELSA-2014-0924.html
- http://linux.oracle.com/errata/ELSA-2014-3047.html
- http://linux.oracle.com/errata/ELSA-2014-3048.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
- http://openwall.com/lists/oss-security/2014/07/17/1
- http://osvdb.org/show/osvdb/109277
- http://rhn.redhat.com/errata/RHSA-2014-1025.html
- http://secunia.com/advisories/59790
Get alerted when CVE-2014-4943 or the next vulnerability affects your stack