Hirashi@hirashi_05
음음음 CVE-2014-3153 취약점 같은걸로 루트권한 탈취하거나 딸깍해서 루팅하고 전부 덤프 딴 다음 역설계해서 토큰박치기 어셈블리제로투 추면 엘지 자체 개발 AP의 디바이스 트리를 만드는 것도 가능하지 않을까??? 커널도 만들 수 있지 않을까?????
1601221.4K
1.1K followersView on X
CVE-2014-3153(canonical / enterprise_linux_server_aus)
LOWCVSS 7.8 · HIGHCISA KEVSignal is active with 1 mentions in latest observed window
Immediate actions
- Track advisory updates for patch or workaround availability
Recommended action window: Monitor and triage in normal cycle
NVD description
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
1.0/ 10 priority
Sources & remediation
Listed in the CISA Known Exploited Vulnerabilities catalog. Federal remediation due date: 2022-06-15. Apply updates per vendor instructions.
Patch / fix
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270
- https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8
- https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e
Exploit / PoC references
Vendor / third-party advisories
Other references
Priority
LOW
Exploitation
ACTIVE
PoC
YES
Patch
AVAILABLE
Momentum
NONE
Are you affected?
If you run products in this scope, you should treat this CVE as relevant to your environment.
- enterprise_linux_server_aus
- linux
- linux_enterprise_desktop
- linux_enterprise_high_availability_extension
Threat summary
- 1 mentions across 1 observed day
What's happening
- 1 total mentions across 1 day
Affected systems
Products
enterprise_linux_server_auslinuxlinux_enterprise_desktoplinux_enterprise_high_availability_extensionlinux_enterprise_real_time_extensionlinux_enterprise_serverlinux_kernelopensuseubuntu_linux
7 versions affected across 9 products
Deep dive
Activity timeline1 mentions / 1d
Full discourse1 post
CPE platform detail14 entries
14 of 14 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | canonical | ubuntu_linux | 12.04 | - | - |
| OS | canonical | ubuntu_linux | 14.04 | - | - |
| OS | linux | linux_kernel | - | - | - |
| OS | opensuse | opensuse | 11.4 | - | - |
| OS | oracle | linux | 5 | - | - |
| OS | oracle | linux | 6 | - | - |
| OS | redhat | enterprise_linux_server_aus | 6.2 | - | - |
| OS | suse | linux_enterprise_desktop | 11 | - | - |
| OS | suse | linux_enterprise_high_availability_extension | 11 | - | - |
| OS | suse | linux_enterprise_real_time_extension | 11 | - | - |
| OS | suse | linux_enterprise_server | 11 | - | - |
| OS | suse | linux_enterprise_server | 11 | - | - |
| OS | suse | linux_enterprise_server | 11 | - | - |
| OS | suse | linux_enterprise_server | 11 | vmware | - |