What’s Vulnerable › Vulnerabilities

CVE-2014-9584

• Severity: low (CVSS 2.1 v2.0)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 0.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2015-01-09 · updated 2026-06-17
• Weakness: CWE-20

Description

The parse_rock_ridge_inode_internal function in fs/isofs/rock.c in the Linux kernel before 3.18.2 does not validate a length value in the Extensions Reference (ER) System Use Field, which allows local users to obtain sensitive information from kernel memory via a crafted iso9660 image.

Affected products

• Canonical Ubuntu Linux: 10.04, 12.04, 14.04, 14.10
• Debian Linux: 7.0, 8.0
• Linux kernel: before 3.18.2 — fixed in 3.18.2
• openSUSE Evergreen: 11.4
• Opensuse: 13.1
• Oracle Corporation Oracle Linux: 5
• RedHat Enterprise Linux Aus: 6.6
• RedHat Enterprise Linux Desktop: 6.0, 7.0
• RedHat Enterprise Linux Eus: 6.6
• RedHat Enterprise Linux Server: 6.0, 7.0
• RedHat Enterprise Linux Server Aus: 7.3, 7.4, 7.6, 7.7
• RedHat Enterprise Linux Server Eus: 7.1, 7.2, 7.3, 7.4, 7.5, 7.6 (+1)
• RedHat Enterprise Linux Server Tus: 6.6, 7.3, 7.6, 7.7
• RedHat Enterprise Linux Workstation: 6.0, 7.0
• SUSE Linux Enterprise Server 15 SP1: 12
• SUSE Linux Enterprise Real Time Extension: 11-sp3
• SUSE Linux Enterprise Server: 10-sp4, 11-sp1, 11-sp2, 12
• SUSE Linux Enterprise Software Development Kit: 12
• SUSE Linux Enterprise Workstation Extension: 12

How to fix

Upgrade to a fixed version: Linux kernel 3.18.2. Check the vendor advisory for mitigations.

References

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4e2024624e678f0ebb916e6192bd23c1f9fdf696
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
• http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00000.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
• http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00020.html
• http://rhn.redhat.com/errata/RHSA-2015-0864.html
• http://rhn.redhat.com/errata/RHSA-2015-1137.html
• http://rhn.redhat.com/errata/RHSA-2015-1138.html
• http://www.debian.org/security/2015/dsa-3128

Get alerted when CVE-2014-9584 or the next vulnerability affects your stack