Bug 508944 (CVE-2014-0181)

Summary:	Kernel: incorrect netlink checks (CVE-2014-0181)
Product:	Gentoo Security	Reporter:	Agostino Sarubbo <ago>
Component:	Kernel	Assignee:	Gentoo Kernel Security <security-kernel>
Status:	RESOLVED FIXED
Severity:	normal	CC:	kernel
Priority:	Normal
Version:	unspecified
Hardware:	All
OS:	Linux
Whiteboard:
Package list:		Runtime testing required:	---

Description Agostino Sarubbo gentoo-dev

2014-04-28 09:18:37 UTC

CVE-2014-0181 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0181):
  The Netlink implementation in the Linux kernel through 3.14.1 does not 
  provide a mechanism for authorizing socket operations based on the opener 
  of a socket, which allows local users to bypass intended access restrictions 
  and modify network configurations by using a Netlink socket for the (1) 
  stdout or (2) stderr of a setuid program.

Comment 1 GLSAMaker/CVETool Bot gentoo-dev

2014-08-10 22:02:56 UTC

CVE-2014-0181 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-0181):
  The Netlink implementation in the Linux kernel through 3.14.1 does not
  provide a mechanism for authorizing socket operations based on the opener of
  a socket, which allows local users to bypass intended access restrictions
  and modify network configurations by using a Netlink socket for the (1)
  stdout or (2) stderr of a setuid program.

Comment 2 John Helmert III archtester

2022-03-25 22:00:27 UTC

Fix in 3.15 as 90f62cf30a78721641e08737bda787552428061e