CVE-2014-3153

MITRE NVD CVE.ORG Print: PDF PDF

Summary

CVECVE-2014-3153
StatePUBLIC
Assigner[email protected]
Source PriorityCVE Program / NVD first with legacy fallback
Published2014-06-07 14:55:00 UTC
Updated2023-11-07 02:19:00 UTC
DescriptionThe futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Risk And Classification

EPSS: 0.688920000 probability, percentile 0.986170000 (date 2026-04-01)

CISA KEV: Listed on 2022-05-25; due 2022-06-15; ransomware use Unknown

Problem Types: CWE-269

CISA Known Exploited Vulnerability

VendorLinux
ProductKernel
NameLinux Kernel Privilege Escalation Vulnerability
Required ActionApply updates per vendor instructions.
Noteshttps://nvd.nist.gov/vuln/detail/CVE-2014-3153

NVD Known Affected Configurations (CPE 2.3)

TypeVendorProductVersionUpdateEditionLanguage
Operating System Linux Linux Kernel All All All All
Operating System Linux Linux Kernel All All All All
Operating System Opensuse Opensuse 11.4 All All All
Operating System Opensuse Opensuse 11.4 All All All
Operating System Redhat Enterprise Linux Server Aus 6.2 All All All
Operating System Redhat Enterprise Linux Server Aus 6.2 All All All
Operating System Suse Linux Enterprise Desktop 11 sp3 All All
Operating System Suse Linux Enterprise Desktop 11 sp3 All All
Operating System Suse Linux Enterprise High Availability Extension 11 sp3 All All
Operating System Suse Linux Enterprise High Availability Extension 11 sp3 All All
Operating System Suse Linux Enterprise Real Time Extension 11 sp3 All All
Operating System Suse Linux Enterprise Real Time Extension 11 sp3 All All
Operating System Suse Linux Enterprise Server 11 - All All
Operating System Suse Linux Enterprise Server 11 sp2 All All
Operating System Suse Linux Enterprise Server 11 sp3 All All
Operating System Suse Linux Enterprise Server 11 sp3 All All
Operating System Suse Linux Enterprise Server 11 - All All
Operating System Suse Linux Enterprise Server 11 sp2 All All
Operating System Suse Linux Enterprise Server 11 sp3 All All
Operating System Suse Linux Enterprise Server 11 sp3 All All

References

ReferenceSourceLinkTags
USN-2237-1: Linux kernel (Quantal HWE) vulnerability | Ubuntu UBUNTU www.ubuntu.com Third Party Advisory
About Secunia Research | Flexera secunia.com
Red Hat Customer Portal rhn.redhat.com
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == u… · torvalds/linux@e9c243a · GitHub CONFIRM github.com Patch, Third Party Advisory
[security-announce] SUSE-SU-2014:1319-1: important: Security update for lists.opensuse.org
linux.oracle.com | ELSA-2014-3038 CONFIRM linux.oracle.com Third Party Advisory
oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153) MLIST openwall.com Mailing List, Third Party Advisory
linux.oracle.com | ELSA-2014-3037 CONFIRM linux.oracle.com Third Party Advisory
kernel/git/torvalds/linux.git - Linux kernel source tree git.kernel.org
kernel/git/torvalds/linux.git - Linux kernel source tree CONFIRM git.kernel.org Patch, Vendor Advisory
USN-2240-1: Linux kernel vulnerabilities | Ubuntu www.ubuntu.com
Linux Kernel PI Futex Requeuing Bug Lets Local Users Gain Elevated Privileges - SecurityTracker www.securitytracker.com
Exploiting CVE-2014-3153 (Towelroot) | Elon Gliksberg MISC elongl.github.io Exploit, Third Party Advisory
[security-announce] openSUSE-SU-2014:0878-1: important: kernel update fi lists.opensuse.org
kernel/git/torvalds/linux.git - Linux kernel source tree git.kernel.org
[security-announce] SUSE-SU-2014:0775-1: critical: Security update for L lists.opensuse.org
Security Advisory SA59029 - Linux Kernel Futex Requeue Privilege Escalation Vulnerability - Secunia secunia.com
oss-security - Linux kernel futex local privilege escalation (CVE-2014-3153) www.openwall.com
kernel/git/torvalds/linux.git - Linux kernel source tree CONFIRM git.kernel.org Patch, Vendor Advisory
oss-security - Re: Linux Kernel: local priv escalation via futexes MISC www.openwall.com Mailing List, Third Party Advisory
oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153) openwall.com
Security Advisory SA59262 - Oracle Linux update for kernel - Secunia SECUNIA secunia.com Third Party Advisory
oss-security - Re: Linux Kernel: local priv escalation via futexes www.openwall.com
About Secunia Research | Flexera secunia.com
About Secunia Research | Flexera SECUNIA secunia.com Third Party Advisory
git.kernel.org git.kernel.org
Bug 1103626 – CVE-2014-3153 kernel: futex: pi futexes requeue issue CONFIRM bugzilla.redhat.com Issue Tracking, Patch, Third Party Advisory
Security Advisory SA59599 - Ubuntu update for kernel - Secunia secunia.com
linux.oracle.com | ELSA-2014-0771 - kernel security and bug fix update CONFIRM linux.oracle.com Third Party Advisory
Security Advisory SA59092 - Oracle Linux update for kernel-uek - Secunia secunia.com
About Secunia Research | Flexera secunia.com
GitHub - elongl/CVE-2014-3153: Exploiting CVE-2014-3153, AKA Towelroot. MISC github.com Third Party Advisory
linux.oracle.com | ELSA-2014-3039 CONFIRM linux.oracle.com Third Party Advisory
[security-announce] SUSE-SU-2014:1316-1: important: Security update for SUSE lists.opensuse.org Mailing List, Third Party Advisory
About Secunia Research | Flexera SECUNIA secunia.com Third Party Advisory
[security-announce] SUSE-SU-2014:0837-1: important: Security update for lists.opensuse.org
Linux Kernel - libfutex - Local Root for RHEL/CentOS 7.0.1406 www.exploit-db.com
Linux Kernel CVE-2014-3153 Local Privilege Escalation Vulnerability BID www.securityfocus.com Third Party Advisory, VDB Entry
[security-announce] SUSE-SU-2014:0796-1: important: Security update for SUSE lists.opensuse.org Mailing List, Third Party Advisory
Debian -- Security Information -- DSA-2949-1 linux www.debian.org
CVE Program record CVE.ORG www.cve.org canonical
NVD vulnerability detail NVD nvd.nist.gov canonical, analysis
CISA Known Exploited Vulnerabilities catalog CISA www.cisa.gov kev
© CVE.report 2026 |

Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. It is the responsibility of user to evaluate the accuracy, completeness or usefulness of any information, opinion, advice or other content. EACH USER WILL BE SOLELY RESPONSIBLE FOR ANY consequences of his or her direct or indirect use of this web site. ALL WARRANTIES OF ANY KIND ARE EXPRESSLY DISCLAIMED. This site will NOT BE LIABLE FOR ANY DIRECT, INDIRECT or any other kind of loss.

CVE, CWE, and OVAL are registred trademarks of The MITRE Corporation and the authoritative source of CVE content is MITRE's CVE web site. This site includes MITRE data granted under the following license.

CVE.report and Source URL Uptime Status status.cve.report