CVE-2014-3631

HighCVSS 7.2/10Last modified Jun 17, 2026

Description

The assoc_array_gc function in the associative-array implementation in lib/assoc_array.c in the Linux kernel before 3.16.3 does not properly implement garbage collection, which allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via multiple "keyctl newring" operations followed by a "keyctl timeout" operation.

Metrics

CVSS 2.0 7.2/10AV:L/AC:L/Au:N/C:C/I:C/A:C

Affected software

Vendor	Product	Versions
n/a	n/a	n/a

References

http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95389b08d93d5c06ec63ab49bd732b0069b7c35eBroken Link
http://osvdb.org/show/osvdb/111298Broken Link
http://www.exploit-db.com/exploits/36268Third Party Advisory, VDB Entry
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Exploit
http://www.securityfocus.com/bid/70095Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1140325Issue Tracking
https://github.com/torvalds/linux/commit/95389b08d93d5c06ec63ab49bd732b0069b7c35eExploit
http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=95389b08d93d5c06ec63ab49bd732b0069b7c35eBroken Link
http://osvdb.org/show/osvdb/111298Broken Link
http://www.exploit-db.com/exploits/36268Third Party Advisory, VDB Entry
http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Exploit
http://www.securityfocus.com/bid/70095Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory, VDB Entry
http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory, VDB Entry
https://bugzilla.redhat.com/show_bug.cgi?id=1140325Issue Tracking
https://github.com/torvalds/linux/commit/95389b08d93d5c06ec63ab49bd732b0069b7c35eExploit

Timeline

Published: Sep 28, 2014
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2014

CVE-2014-36327.6The default configuration in a sudoers file in the Red Hat openstack-neutron package before 2014.1.2-4, as used in Red Hat Enterprise Linux CVE-2014-36335.8The qemuDomainGetBlockIoTune function in qemu/qemu_driver.c in libvirt before 1.2.9, when a disk has been hot-plugged or removed from the li CVE-2014-36347.5rsyslog before 7.6.6 and 8.x before 8.4.1 and sysklogd 1.5 and earlier allows remote attackers to cause a denial of service (crash), possibl CVE-2014-36354.4Off-by-one error in D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8, when running on a 64-bit system and the max_message_unix CVE-2014-36361.9D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 allows local users to (1) cause a denial of service (prevention of new connec CVE-2014-36372.1D-Bus 1.3.0 through 1.6.x before 1.6.24 and 1.8.x before 1.8.8 does not properly close connections for processes that have terminated, which CVE-2014-36382.1The bus_connections_check_reply function in config-parser.c in D-Bus before 1.6.24 and 1.8.x before 1.8.8 allows local users to cause a deni CVE-2014-36392.1The dbus-daemon in D-Bus before 1.6.24 and 1.8.x before 1.8.8 does not properly close old connections, which allows local users to cause a d CVE-2014-36402.1The sosendto function in slirp/udp.c in QEMU before 2.1.2 allows local users to cause a denial of service (NULL pointer dereference) by send CVE-2014-36414.0The (1) GlusterFS and (2) Linux Smbfs drivers in OpenStack Cinder before 2014.1.3 allows remote authenticated users to obtain file data from CVE-2014-36426.5vmdb/app/controllers/application_controller/performance.rb in Red Hat CloudForms 3.1 Management Engine (CFME) before 5.3 allows remote authe CVE-2014-36437.5jersey: XXE via parameter entities not disabled by the jersey SAX parser