CVE-2014-0102

MediumCVSS 5.2/10Last modified Jun 17, 2026

Description

The keyring_detect_cycle_iterator function in security/keys/keyring.c in the Linux kernel through 3.13.6 does not properly determine whether keyrings are identical, which allows local users to cause a denial of service (OOPS) via crafted keyctl commands.

Metrics

CVSS 2.0 5.2/10AV:A/AC:M/Au:S/C:N/I:N/A:C

Weakness enumeration

CWE-310

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://lkml.org/lkml/2014/2/27/507Third Party Advisory
http://www.kernelhub.org/?msg=425013&p=2Broken Link
http://www.openwall.com/lists/oss-security/2014/03/04/21Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1072419Issue Tracking, Patch, Third Party Advisory
http://lkml.org/lkml/2014/2/27/507Third Party Advisory
http://www.kernelhub.org/?msg=425013&p=2Broken Link
http://www.openwall.com/lists/oss-security/2014/03/04/21Mailing List, Patch, Third Party Advisory
https://bugzilla.redhat.com/show_bug.cgi?id=1072419Issue Tracking, Patch, Third Party Advisory

Timeline

Published: Mar 11, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-01032.1WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive CVE-2014-01045.9In fence-agents before 4.0.17 does not verify remote SSL certificates in the fence_cisco_ucs.py script which can potentially allow for man-i CVE-2014-01056.0The auth_token middleware in the OpenStack Python client library for Keystone (aka python-keystoneclient) before 0.7.0 does not properly ret CVE-2014-01066.6Sudo 1.6.9 before 1.8.5, when env_reset is disabled, does not properly check environment variables for the env_delete restriction, which all CVE-2014-01077.5The TransformerFactory in Apache Xalan-Java before 2.7.2 does not properly restrict access to certain properties when FEATURE_SECURE_PROCESS CVE-2014-01094.3Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (memory consumption) via a large reque CVE-2014-01104.3Apache CXF before 2.6.14 and 2.7.x before 2.7.11 allows remote attackers to cause a denial of service (/tmp disk consumption) via a large in CVE-2014-01116.5Apache Syncope 1.0.0 before 1.0.9 and 1.1.0 before 1.1.7 allows remote administrators to execute arbitrary Java code via vectors related to CVE-2014-01127.5ParametersInterceptor in Apache Struts before 2.3.20 does not properly restrict access to the getClass method, which allows remote attackers CVE-2014-01137.5CookieInterceptor in Apache Struts before 2.3.20, when a wildcard cookiesName value is used, does not properly restrict access to the getCla CVE-2014-01147.5Apache Commons BeanUtils, as distributed in lib/commons-beanutils-1.8.0.jar in Apache Struts 1.x through 1.3.10 and in other products requir CVE-2014-01157.5Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a .. (dot do