CVE-2014-8159

N/A

Published: March 16, 2015 at 10:00 AM UTC

Updated: June 17, 2026 at 12:16 AM UTC

3 products affected across 3 vendorsLinux KernelDebian LinuxUbuntu Linux

Using N/A by N/A?

Get instant alerts when new vulnerabilities affect N/A - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

N/A

Exploit prediction

EPSS 0.4%

Description

The InfiniBand (IB) implementation in the Linux kernel package before 2.6.32-504.12.2 on Red Hat Enterprise Linux (RHEL) 6 does not properly restrict use of User Verbs for registration of memory regions, which allows local users to access arbitrary physical memory locations, and consequently cause a denial of service (system crash) or gain privileges, by leveraging permissions on a uverbs device under /dev/infiniband/.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Ubuntu Linux · Canonicalrubygems

95%

10.04 12.04 14.04 14.10

Debian Linux · Debiandrupal

95%

7.0 8.0

Linux Kernel · Linux

95%

2.6.12 ≤ v < 3.2.693.11 ≤ v < 3.12.413.13 ≤ v < 3.14.393.15 ≤ v < 3.16.353.17 ≤ v < 3.18.133.19 ≤ v < 3.19.53.3 ≤ v < 3.4.1083.5 ≤ v < 3.10.75

Affected range stops below 3.10.75, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.12.41, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.14.39, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.16.35, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.18.13, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.19.5, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.2.69, so it looks safe — our inference, not a vendor statement

Affected range stops below 3.4.108, so it looks safe — our inference, not a vendor statement

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

References (27)

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

http://kb.juniper.net/InfoCenter/index?page=content&id=JSA10705

Vendor Advisoryx_refsource_FEDORAMailing ListThird Party Advisory

Source: [email protected]

http://lists.fedoraproject.org/pipermail/package-announce/2015-March/152747.html