CVE-2014-5472

Severity: medium (CVSS 4.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2014-09-01 · updated 2026-06-17
Weakness: CWE-20

Description

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel through 3.16.1 allows local users to cause a denial of service (unkillable mount process) via a crafted iso9660 image with a self-referential CL entry.

Affected products

Linux kernel: through 3.16.1; 3.16.0

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=410dd3cf4c9b36f27ed4542ee18b1af5e68645a4
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
http://marc.info/?l=bugtraq&m=142722450701342&w=2
http://marc.info/?l=bugtraq&m=142722544401658&w=2
http://rhn.redhat.com/errata/RHSA-2014-1318.html
http://rhn.redhat.com/errata/RHSA-2015-0102.html
http://rhn.redhat.com/errata/RHSA-2015-0695.html
http://rhn.redhat.com/errata/RHSA-2015-0782.html

Get alerted when CVE-2014-5472 or the next vulnerability affects your stack