CVE-2014-9419
Not scored
CVE-2014-9419
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.
Exploit probability
0.4%
Published
December 26, 2014
Required by
Not available
Last source change
April 16, 2026
03 / CONNECTIONS
Connected vulnerabilities
04 / EVIDENCE
Source records
Open Source Vulnerabilities
CVE-2014-9419
View original source
The __switch_to function in arch/x86/kernel/process_64.c in the Linux kernel through 3.18.1 does not ensure that Thread Local Storage (TLS) descriptors are loaded before proceeding with other steps, which makes it easier for local users to bypass the ASLR protection mechanism via a crafted application that reads a TLS base address.
05 / REFERENCES
Further evidence
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=f647d7c155f069c1a068030255c300663516420e
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147864.html
- http://lists.fedoraproject.org/pipermail/package-announce/2015-January/147973.html
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00020.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00009.html
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.html
- http://rhn.redhat.com/errata/RHSA-2015-1081.html
- http://www.debian.org/security/2015/dsa-3128
- http://www.mandriva.com/security/advisories?name=MDVSA-2015:058
- http://www.openwall.com/lists/oss-security/2014/12/25/1
- http://www.securityfocus.com/bid/71794
- http://www.ubuntu.com/usn/USN-2515-1
- http://www.ubuntu.com/usn/USN-2516-1
- http://www.ubuntu.com/usn/USN-2517-1
- http://www.ubuntu.com/usn/USN-2518-1
- http://www.ubuntu.com/usn/USN-2541-1
- http://www.ubuntu.com/usn/USN-2542-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1177260
- https://github.com/torvalds/linux/commit/f647d7c155f069c1a068030255c300663516420e