CVE-2014-0203

MediumCVSS 5.5/10Last modified Jun 17, 2026

Description

The __do_follow_link function in fs/namei.c in the Linux kernel before 2.6.33 does not properly handle the last pathname component during use of certain filesystems, which allows local users to cause a denial of service (incorrect free operations and system crash) via an open system call.

Metrics

CVSS 3.1 5.5/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-416

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=86acdca1b63e6890540fa19495cfc708beff3d8b
http://linux.oracle.com/errata/ELSA-2014-0771.htmlThird Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3043.htmlThird Party Advisory
http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link
http://secunia.com/advisories/59262Broken Link
http://secunia.com/advisories/59309Broken Link
http://secunia.com/advisories/59406Broken Link
http://secunia.com/advisories/59560Broken Link
http://www.securityfocus.com/bid/68125Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1094363Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/86acdca1b63e6890540fa19495cfc708beff3d8bPatch, Third Party Advisory
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=86acdca1b63e6890540fa19495cfc708beff3d8b
http://linux.oracle.com/errata/ELSA-2014-0771.htmlThird Party Advisory
http://linux.oracle.com/errata/ELSA-2014-3043.htmlThird Party Advisory
http://mirror.linux.org.au/linux/kernel/v2.6/ChangeLog-2.6.33Broken Link
http://secunia.com/advisories/59262Broken Link
http://secunia.com/advisories/59309Broken Link
http://secunia.com/advisories/59406Broken Link
http://secunia.com/advisories/59560Broken Link
http://www.securityfocus.com/bid/68125Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1094363Exploit, Issue Tracking, Patch, Third Party Advisory
https://github.com/torvalds/linux/commit/86acdca1b63e6890540fa19495cfc708beff3d8bPatch, Third Party Advisory

Timeline

Published: Jun 23, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-02046.5OpenStack Identity (Keystone) before 2014.1.1 does not properly handle when a role is assigned to a group that has the same ID as a user, wh CVE-2014-02056.9The futex_wait function in kernel/futex.c in the Linux kernel before 2.6.37 does not properly maintain a certain reference count during requ CVE-2014-02062.1Array index error in the aio_read_events_ring function in fs/aio.c in the Linux kernel through 3.15.1 allows local users to obtain sensitive CVE-2014-02076.5The cdf_read_short_sector function in cdf.c in file before 5.19, as used in the Fileinfo component in PHP before 5.4.30 and 5.5.x before 5.5 CVE-2014-02085.4Cross-site scripting (XSS) vulnerability in the search auto-completion functionality in Foreman before 1.4.4 allows remote authenticated use CVE-2014-02094.6Multiple integer overflows in the (1) FontFileAddEntry and (2) lexAlias functions in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.90 CVE-2014-02107.5Multiple buffer overflows in X.Org libXfont before 1.4.8 and 1.4.9x before 1.4.99.901 allow remote font servers to execute arbitrary code vi CVE-2014-02117.5Multiple integer overflows in the (1) fs_get_reply, (2) fs_alloc_glyphs, and (3) fs_read_extent_info functions in X.Org libXfont before 1.4.CVE-2014-02127.5qpid-cpp: ACL policies only loaded if the acl-file option specified enabling DoS by consuming all available file descriptors CVE-2014-02136.8Multiple cross-site request forgery (CSRF) vulnerabilities in mod/assign/locallib.php in the Assignment subsystem in Moodle through 2.3.11, CVE-2014-02146.8login/token.php in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 creates a MoodleMobile web-service CVE-2014-02154.0The blind-marking implementation in Moodle through 2.3.11, 2.4.x before 2.4.10, 2.5.x before 2.5.6, and 2.6.x before 2.6.3 allows remote aut