CVE-2014-0131

Published: 24 March 2014

Use-after-free vulnerability in the skb_segment function in net/core/skbuff.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation.

From the Ubuntu Security Team

Michael S. Tsirkin discovered an information leak in the Linux kernel's segmentation of skbs when using the zerocopy feature of vhost-net. A local attacker could exploit this flaw to gain potentially sensitive information from kernel memory.

Notes

android kernels (goldfish, grouper, maguro, mako and manta) are not
supported on the Ubuntu Touch 13.10 preview kernels

Also needs the following:
a5c39b046fdf5025ab4d274edaf5d8f53326b34c skbuff: skb_segment: s/fskb/list_skb/
cff87de1c2625eadcd1b38f14d3a036e160aefa3 skbuff: skb_segment: s/skb/head_skb/
ef92873b71a1879a19d64575725a7bbf8c59d9f6 skbuff: skb_segment: s/skb_frag/frag/
c4d421e6e53be12b422b5d6ff93bf6c1d6cc83d5 skbuff: skb_segment: s/frag/nskb_frag/

Status

References

• https://github.com/torvalds/linux/commit/1fd819ecb90cc9b822cd84d3056ddba315d3340f
• https://bugzilla.redhat.com/show_bug.cgi?id=1074589
• http://www.spinics.net/lists/netdev/msg274316.html
• http://www.spinics.net/lists/netdev/msg274250.html
• http://www.openwall.com/lists/oss-security/2014/03/10/4
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git;a=commit;h=1fd819ecb90cc9b822cd84d3056ddba315d3340f
• https://ubuntu.com/security/notices/USN-2283-1
• https://ubuntu.com/security/notices/USN-2284-1
• https://ubuntu.com/security/notices/USN-2285-1
• https://ubuntu.com/security/notices/USN-2286-1
• https://ubuntu.com/security/notices/USN-2287-1
• https://ubuntu.com/security/notices/USN-2289-1
• https://www.cve.org/CVERecord?id=CVE-2014-0131
• NVD
• Launchpad
• Debian

Bugs

• https://launchpad.net/bugs/1298119