CVE-2014-9940 is a use-after-free vulnerability in the Linux kernel (before version 3.19) affecting Google Android and Linux kernel products. This flaw, residing in the regulator_ena_gpio_free function, allows local users to potentially gain privileges or cause a denial of service. With a CVSS score of 7.0 (High), it requires high attack complexity and user interaction, but could lead to significant confidentiality, integrity, and availability impacts. Despite its severity, there is no evidence of active exploitation, public exploit code (Metasploit, Nuclei, ExploitDB), or significant community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
> 3.10, < 3.16.45CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
>= 3.17, < 3.18.52CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* | ||
3.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:3.10:-:*:*:*:*:*:* | ||
3.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:3.10:rc1:*:*:*:*:*:* | ||
3.10CPE matchmatch criteria | cpe:2.3:o:linux:linux_kernel:3.10:rc2:*:*:*:*:*:* |
CVSS version used by this source: 3.1
CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.0 Bluesky, 0.1 Mastodon, and 0.0 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.2 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
The regulator_ena_gpio_free function in drivers/regulator/core.c in the Linux kernel before 3.19 allows local users to gain privileges or cause a denial of service (use-after-free) via a crafted application.
May 9, 2017kernel: Use-after-free in the regulator_ena_gpio_free function
Dec 4, 2014