7.8High KEV

CVE-2014-3153Linux Kernel Privilege Escalation Vulnerability

linux linux kernel; redhat enterprise linux server aus; opensuse opensuse; suse linux enterprise desktop Published: 2014-06-07 17:00 (12 years ago)

Known exploited — Linux Kernel Privilege Escalation Vulnerability

CISA confirmed this vulnerability is used in real attacks on 25.05.2022. Remediation deadline for US federal agencies: 15.06.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2014-3153

Description

The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
canonical	ubuntu linux	12.04
linux	linux kernel	< 3.2.60
opensuse	opensuse	11.4
oracle	linux	5
redhat	enterprise linux server aus	6.2
suse	linux enterprise desktop	11
suse	linux enterprise high availability extension	11
suse	linux enterprise real time extension	11
suse	linux enterprise server	11

References and patches

67906 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
openSUSE-SU-2014:0878 vendor-advisoryMailing ListThird Party Advisory
[oss-security] 20140605 Re: Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-listMailing List
59029 third-party-advisoryBroken Link
DSA-2949 vendor-advisoryExploit
SUSE-SU-2014:1316 vendor-advisoryMailing ListThird Party Advisory
SUSE-SU-2014:0796 vendor-advisoryMailing ListThird Party Advisory
59262 third-party-advisoryBroken Link
58990 third-party-advisoryBroken Link
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=13fbca4c6ecd96ec1a1cfa2e4f2ce191fe928a5e Mailing ListPatch
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=54a217887a7b658e2650c3feff22756ab80c7339 Mailing ListPatch
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d3534… Broken Link
http://linux.oracle.com/errata/ELSA-2014-3037.html Third Party Advisory
59153 third-party-advisoryBroken Link
[oss-security] 20140606 Re: Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-listMailing List
59309 third-party-advisoryBroken Link
https://github.com/torvalds/linux/commit/e9c243a5a6de0be8e584c604d353412584b592f8 Patch
1030451 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
http://linux.oracle.com/errata/ELSA-2014-0771.html Third Party Advisory
SUSE-SU-2014:0775 vendor-advisoryMailing ListThird Party Advisory
RHSA-2014:0800 vendor-advisoryThird Party Advisory
USN-2237-1 vendor-advisoryThird Party Advisory
SUSE-SU-2014:1319 vendor-advisoryMailing ListThird Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3039.html Third Party Advisory
https://git.kernel.org/cgit/linux/kernel/git/torvalds/linux.git/commit/?id=b3eaa9fc5cd0a4d74b18f6b8dc617aeaf1873270 Mailing ListPatch
58500 third-party-advisoryBroken Link
USN-2240-1 vendor-advisoryThird Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1103626 Issue TrackingThird Party Advisory
59386 third-party-advisoryBroken Link
35370 exploitThird Party AdvisoryVDB Entry
59599 third-party-advisoryBroken Link
SUSE-SU-2014:0837 vendor-advisoryMailing ListThird Party Advisory
[oss-security] 20140605 Linux kernel futex local privilege escalation (CVE-2014-3153) mailing-listMailing List
59092 third-party-advisoryBroken Link
http://linux.oracle.com/errata/ELSA-2014-3038.html Third Party Advisory
[oss-security] 20210201 Re: Linux Kernel: local priv escalation via futexes mailing-listMailing List
https://www.openwall.com/lists/oss-security/2021/02/01/4 Mailing List
https://elongl.github.io/exploitation/2021/01/08/cve-2014-3153.html Exploit
https://github.com/elongl/CVE-2014-3153 Third Party Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2014-3153 US Government Resource

CPE matches (NVD) (18)

cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* < 3.2.60
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.3 < 3.4.92
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.5 < 3.10.42
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.11 < 3.12.22
cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* ≥ 3.13 < 3.14.6
cpe:2.3:o:redhat:enterprise_linux_server_aus:6.2:*:*:*:*:*:*:*
cpe:2.3:o:opensuse:opensuse:11.4:*:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_desktop:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_high_availability_extension:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_real_time_extension:11:sp3:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:-:*:*:*:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp2:*:*:ltss:*:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:-:*:*
cpe:2.3:o:suse:linux_enterprise_server:11:sp3:*:*:*:vmware:*:*
cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*
cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:esm:*:*:*
cpe:2.3:o:oracle:linux:5:-:*:*:*:*:*:*
cpe:2.3:o:oracle:linux:6:-:*:*:*:*:*:*

CVSS score

7.8High

Source: CISA-ADP · CVSS 3.1

Attack vector: Local
Attack complexity: Low
Privileges required: Low
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: High

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

All scores (4)

CISA-ADP	CVSS 3.1	7.8High
nvd	CVSS 3.1	7.8High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.8High
nvd	CVSS 2.0	7.2High

EPSS (chance of exploitation in 30 days)

37.23%

higher than 99% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2014-05-03
Published2014-06-07 17:00
Reached IP-DB2026-10-24 23:32
Added to KEV2022-05-25
Last updated2026-06-17 03:07

Assigned by (CNA): Chrome
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Linux kernel

Unscored

CVE-2026-99241 2 hours ago

ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite()

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ntfs: take invalidate_lock in ntfs_filemap_page_mkwrite() ntfs_filemap_page_mkwrite() calls iomap_page_mkwrite() without holding mapping->invalidate_lock, so a concurrent truncate or falloc…

Unscored

CVE-2026-99242 2 hours ago

ntfs: fix race between fallocate and mmap reads

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: ntfs: fix race between fallocate and mmap reads The fallocate implementation only takes invalidate_lock for punch hole, collapse range, and insert range operations. For standard allocation …

7.8High

CVE-2026-99239 2 hours ago

Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: Bluetooth: L2CAP: refuse __l2cap_chan_add if chan already has conn l2cap_chan may be linked to l2cap_conn at most once. This is assumed in several places, eg l2cap_chan_del cleanup. There …

Unscored

CVE-2026-99240 2 hours ago

mm/damon/core: error damos_commit_quota_goal() for zero target_value

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: mm/damon/core: error damos_commit_quota_goal() for zero target_value Patch series "mm/damon: move zero damos quota target_value handling to the core layer". Having zero DAMOS quota target …

7.8High

CVE-2026-99237 2 hours ago

tracing: Hold trace_types_lock when resetting last boot data from readers

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when resetting last boot data from readers update_last_data_if_empty() is called from tracing_open() with O_TRUNC, tracing_read_pipe() and tracing_buffers_rea…

7.8High

CVE-2026-99238 2 hours ago

tracing: Hold trace_types_lock when updating modules in persistent instances

Linux Linux

In the Linux kernel, the following vulnerability has been resolved: tracing: Hold trace_types_lock when updating modules in persistent instances trace_module_record() walks ftrace_trace_arrays from the module notifier without trace_types_lock. A concurrent …