CVE-2014-2568

2014-03-2400:00:00

ubuntu.com

2.9 Low

CVSS2

Access Vector

ADJACENT_NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:A/AC:M/Au:N/C:P/I:N/A:N

0.001 Low

EPSS

Percentile

37.2%

JSON

Use-after-free vulnerability in the nfqnl_zcopy function in
net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6
allows attackers to obtain sensitive information from kernel memory by
leveraging the absence of a certain orphaning operation. NOTE: the affected
code was moved to the skb_zerocopy function in net/core/skbuff.c before the
vulnerability was announced.

Bugs

<https://launchpad.net/bugs/1297743>

Notes

Author	Note
jdstrand	android kernels (goldfish, grouper, maguro, mako and manta) are not supported on the Ubuntu Touch 13.10 preview kernels
mdeslaur	v3: https://lkml.org/lkml/2014/3/20/421
apw	v4: http://www.mail-archive.com/[email protected]/msg100545.html

OSVersionArchitecturePackageVersionFilename
ubuntu13.10noarchlinux< 3.11.0-23.40UNKNOWN
ubuntu14.04noarchlinux< 3.13.0-29.53UNKNOWN
ubuntu12.04noarchlinux-lts-saucy< 3.11.0-23.40~precise1UNKNOWN
ubuntu12.04noarchlinux-lts-trusty< 3.13.0-29.53~precise1UNKNOWN

OS	Version	Architecture	Package	Version	Filename
ubuntu	13.10	noarch	linux	< 3.11.0-23.40	UNKNOWN
ubuntu	14.04	noarch	linux	< 3.13.0-29.53	UNKNOWN
ubuntu	12.04	noarch	linux-lts-saucy	< 3.11.0-23.40~precise1	UNKNOWN
ubuntu	12.04	noarch	linux-lts-trusty	< 3.13.0-29.53~precise1	UNKNOWN