Bug 506432 (CVE-2014-2678)

Summary:	Kernel: dereference of a NULL device in rds_iw_laddr_check (CVE-2014-2678)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2014-04-01 10:39:38 UTC

CVE-2014-2678 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2678):

The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to 
cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other 
impact via a bind system call for an RDS socket on a system that lacks RDS transports.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2014-08-10 21:56:12 UTC

CVE-2014-2678 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-2678):
  The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through
  3.14 allows local users to cause a denial of service (NULL pointer
  dereference and system crash) or possibly have unspecified other impact via
  a bind system call for an RDS socket on a system that lacks RDS transports.

Comment 2 John Helmert III archtester

2022-03-25 21:56:36 UTC

Fix in 3.15 as bf39b4247b8799935ea91d90db250ab608a58e50