Home

CVE-2014-8159

Description

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.

Risk Information

Base Score
10.0
MODERATE
Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
EPSS Score
Exploitation Probability
0.142

Associated Vulnerability

VulnerabilityOS Platform
Dtrace-modules-3.8.13-68.1.2.el6uek update (ELSA-2015-3019) dtrace-modules-3.8.13-68.1.2.el6uek-0.4.3-4.el6.x86_64.rpmLinux
Dtrace-modules-3.8.13-68.1.2.el7uek update (ELSA-2015-3019) dtrace-modules-3.8.13-68.1.2.el7uek-0.4.3-4.el7.x86_64.rpmLinux
Dtrace-modules-3.8.13-68.2.2.el6uek update (ELSA-2015-3035) dtrace-modules-3.8.13-68.2.2.el6uek-0.4.3-4.el6.x86_64.rpmLinux
Dtrace-modules-3.8.13-68.2.2.el7uek update (ELSA-2015-3035) dtrace-modules-3.8.13-68.2.2.el7uek-0.4.3-4.el7.x86_64.rpmLinux
Dtrace-modules-3.8.13-98.el6uek update (ELSA-2015-3064) dtrace-modules-3.8.13-98.el6uek-0.4.5-2.el6.x86_64.rpmLinux
Dtrace-modules-3.8.13-98.el7uek update (ELSA-2015-3064) dtrace-modules-3.8.13-98.el7uek-0.4.5-3.el7.x86_64.rpmLinux
CVE-2014-8159NCM

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234