CVEvulnerability

CVE-2014-3153

7.8 HIGH Known exploited Published 2014-06-07 Modified 2026-06-17 Official page ↗

CISA Known Exploited Vulnerability

Linux Kernel Privilege Escalation Vulnerability — Linux Kernel

The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.

Added to KEV
2022-05-25
Remediation due
2022-06-15
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Notes
https://nvd.nist.gov/vuln/detail/CVE-2014-3153
Status
Analyzed
Published
2014-06-07
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
7.8 HIGH — CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
7.2 HIGH — AV:L/AC:L/Au:N/C:C/I:C/A:C

Description

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Affected configurations

• linux linux kernel (< 3.2.60) • linux linux kernel (>= 3.3 < 3.4.92) • linux linux kernel (>= 3.5 < 3.10.42) • linux linux kernel (>= 3.11 < 3.12.22) • linux linux kernel (>= 3.13 < 3.14.6) • redhat enterprise linux server aus 6.2 • opensuse opensuse 11.4 • suse linux enterprise desktop 11 • suse linux enterprise high availability extension 11 • suse linux enterprise real time extension 11 • suse linux enterprise server 11 • canonical ubuntu linux 12.04 • canonical ubuntu linux 14.04 • oracle linux 5 • oracle linux 6

References