CVE-2014-4699 is a local privilege escalation and denial-of-service vulnerability affecting the Linux kernel before version 3.15.4 on Intel processors, specifically impacting Canonical and Debian distributions. It arises from improper handling of the saved RIP address during system calls that don't use IRET, allowing a race condition to be exploited via crafted ptrace and fork calls. With a CVSS score of 6.9, this vulnerability has a medium attack complexity and can lead to complete compromise of confidentiality, integrity, and availability. While not listed in CISA KEV, an ExploitDB entry (EDB-34134) exists, and it has garnered significant community discussion and media coverage, indicating its relevance despite its age.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
>= 2.6.17, < 3.2.61CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.3, < 3.4.97CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.5, < 3.10.47CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.11, < 3.12.25CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.13, < 3.14.11CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:L/AC:M/Au:N/C:C/I:C/A:C
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.