Vulnerability Details : CVE-2014-3153
Public exploit exists!
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
CVE-2014-3153 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Linux Kernel Privilege Escalation Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
Added on
2022-05-25
Action due date
2022-06-15
Exploit prediction scoring system (EPSS) score for CVE-2014-3153
Probability of exploitation activity in the next 30 days: 0.13%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 47 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2014-3153
-
Android 'Towelroot' Futex Requeue Kernel Exploit
Disclosure Date: 2014-05-03First seen: 2020-04-26exploit/android/local/futex_requeueThis module exploits a bug in futex_requeue in the Linux kernel, using similar techniques employed by the towelroot exploit. Any Android device with a kernel built before June 2014 is likely to be vulnerable. Authors: - Pinkie Pie - geohot - timw
CVSS scores for CVE-2014-3153
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
---|---|---|---|---|---|
7.2
|
HIGH | AV:L/AC:L/Au:N/C:C/I:C/A:C |
3.9
|
10.0
|
NIST |
CWE ids for CVE-2014-3153
-
The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor.Assigned by: nvd@nist.gov (Primary)
References for CVE-2014-3153
-
https://github.com/elongl/CVE-2014-3153
GitHub - elongl/CVE-2014-3153: Exploiting CVE-2014-3153, AKA Towelroot.Third Party Advisory
-
https://bugzilla.redhat.com/show_bug.cgi?id=1103626
1103626 – (CVE-2014-3153) CVE-2014-3153 kernel: futex: pi futexes requeue issueIssue Tracking;Patch;Third Party Advisory
-
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8
futex-prevent-requeue-pi-on-same-futex.patch futex: Forbid uaddr == u… · torvalds/linux@e9c243a · GitHubPatch;Third Party Advisory
-
http://www.debian.org/security/2014/dsa-2949
Debian -- Security Information -- DSA-2949-1 linuxThird Party Advisory
-
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://secunia.com/advisories/59029
Sign inThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
[security-announce] SUSE-SU-2014:1316-1: important: Security update forMailing List;Third Party Advisory
-
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://openwall.com/lists/oss-security/2014/06/05/24
oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153)Mailing List;Third Party Advisory
-
http://secunia.com/advisories/59386
Sign inThird Party Advisory
-
http://secunia.com/advisories/59309
Sign inThird Party Advisory
-
http://secunia.com/advisories/58990
Sign inThird Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.html
[security-announce] SUSE-SU-2014:0837-1: important: Security update forMailing List;Third Party Advisory
-
http://www.securitytracker.com/id/1030451
Linux Kernel PI Futex Requeuing Bug Lets Local Users Gain Elevated Privileges - SecurityTrackerThird Party Advisory;VDB Entry
-
http://openwall.com/lists/oss-security/2014/06/06/20
oss-security - Re: Linux kernel futex local privilege escalation (CVE-2014-3153)Mailing List;Third Party Advisory
-
http://secunia.com/advisories/59262
Sign inThird Party Advisory
-
http://rhn.redhat.com/errata/RHSA-2014-0800.html
RHSA-2014:0800 - Security Advisory - Red Hat Customer PortalThird Party Advisory
-
http://www.exploit-db.com/exploits/35370
Linux Kernel 3.14.5 (CentOS 7 / RHEL) - 'libfutex' Local Privilege Escalation - Linux local ExploitExploit;Third Party Advisory;VDB Entry
-
http://lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.html
[security-announce] openSUSE-SU-2014:0878-1: important: kernel update fiMailing List;Third Party Advisory
-
http://secunia.com/advisories/59153
Sign inThird Party Advisory
-
https://www.openwall.com/lists/oss-security/2021/02/01/4
oss-security - Re: Linux Kernel: local priv escalation via futexesMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2240-1
USN-2240-1: Linux kernel vulnerabilities | Ubuntu security noticesThird Party Advisory
-
http://www.openwall.com/lists/oss-security/2014/06/05/22
oss-security - Linux kernel futex local privilege escalation (CVE-2014-3153)Mailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.html
[security-announce] SUSE-SU-2014:0796-1: important: Security update forMailing List;Third Party Advisory
-
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=e9c243a5a6de0be8e584c604d353412584b592f8
kernel/git/torvalds/linux.git - Linux kernel source treePatch;Vendor Advisory
-
http://linux.oracle.com/errata/ELSA-2014-3039.html
linux.oracle.com | ELSA-2014-3039Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
[security-announce] SUSE-SU-2014:1319-1: important: Security update forMailing List;Third Party Advisory
-
http://linux.oracle.com/errata/ELSA-2014-0771.html
linux.oracle.com | ELSA-2014-0771Third Party Advisory
-
http://secunia.com/advisories/59599
Sign inThird Party Advisory
-
http://linux.oracle.com/errata/ELSA-2014-3037.html
linux.oracle.com | ELSA-2014-3037Third Party Advisory
-
http://www.openwall.com/lists/oss-security/2021/02/01/4
oss-security - Re: Linux Kernel: local priv escalation via futexesMailing List;Third Party Advisory
-
http://lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.html
[security-announce] SUSE-SU-2014:0775-1: critical: Security update for LMailing List;Third Party Advisory
-
http://www.ubuntu.com/usn/USN-2237-1
USN-2237-1: Linux kernel (Quantal HWE) vulnerability | Ubuntu security noticesThird Party Advisory
-
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html
Exploiting CVE-2014-3153 (Towelroot) | Elon GliksbergExploit;Third Party Advisory
-
http://secunia.com/advisories/59092
Sign inThird Party Advisory
-
http://linux.oracle.com/errata/ELSA-2014-3038.html
linux.oracle.com | ELSA-2014-3038Third Party Advisory
-
http://www.securityfocus.com/bid/67906
Linux Kernel CVE-2014-3153 Local Privilege Escalation VulnerabilityThird Party Advisory;VDB Entry
-
http://secunia.com/advisories/58500
Sign inThird Party Advisory
Products affected by CVE-2014-3153
- cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
- cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
- cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*
- cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*