Linux Kernel 'fs/ecryptfs/crypto.c' Local Buffer Overflow Vulnerability

Bugtraq ID:	72643
Class:	Boundary Condition Error
CVE:	CVE-2014-9683
Remote:	No
Local:	Yes
Published:	Feb 17 2015 12:00AM
Updated:	Feb 11 2016 07:48AM
Credit:	Dmitry Chernenkov
Vulnerable:	Ubuntu Ubuntu Linux 12.04 LTS i386 Ubuntu Ubuntu Linux 12.04 LTS amd64 Red Hat Enterprise Linux Workstation Optional 6 Red Hat Enterprise Linux Workstation 6 Red Hat Enterprise Linux Server Optional 6 Red Hat Enterprise Linux Server 6 Red Hat Enterprise Linux HPC Node Optional 6 Red Hat Enterprise Linux HPC Node 6 Red Hat Enterprise Linux Desktop Optional 6 Red Hat Enterprise Linux Desktop 6 Oracle Enterprise Linux 6.2 Oracle Enterprise Linux 6 Linux kernel AlienVault Open Source SIEM (OSSIM) 3.1
Not Vulnerable:

Linux Kernel 'fs/ecryptfs/crypto.c' Local Buffer Overflow Vulnerability

The Linux kernel is prone to a local buffer-overflow vulnerability because it fails to perform adequate boundary checks on user-supplied data.

Local attackers can exploit this issue to run arbitrary code with elevated privileges. Failed exploit attempts can crash the affected kernel, denying service to legitimate users.

Linux Kernel 'fs/ecryptfs/crypto.c' Local Buffer Overflow Vulnerability

Currently we are not aware of any working exploits. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].

Linux Kernel 'fs/ecryptfs/crypto.c' Local Buffer Overflow Vulnerability

Solution:
Updates are available. Please see the references or vendor advisory for more information.

Linux Kernel 'fs/ecryptfs/crypto.c' Local Buffer Overflow Vulnerability

References:

• Linux kernel Homepage (kernel.org)