CVE-2014-9900: Linux Kernel ethtool_get_wol Function Information Disclosure
Summary
CVE-2014-9900: The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not initialize a certain data structure, which allows local u... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Linux kernel is a widely used open-source operating system kernel that serves as the foundation for various Linux distributions. It provides essential functionality for the operating system, including device drivers, memory management, and process scheduling. The ethtool_get_wol function is a part of the kernel's networking subsystem and is responsible for retrieving Wake-on-LAN (WoL) settings for network interfaces. However, a vulnerability in this function allows local users to obtain sensitive information by exploiting a flaw in the initialization of a data structure. This vulnerability affects the Linux kernel versions up to 4.7 and has been observed in Android devices, specifically Nexus 5 and 7 (2013) models.
Vulnerability Detail
The vulnerability arises due to the failure to properly initialize a data structure in the ethtool_get_wol function. By leveraging this flaw, local users can gain access to sensitive information through a crafted application. This information disclosure vulnerability has been identified as Android internal bug 28803952 and Qualcomm internal bug CR570754. The impact of this vulnerability can vary depending on the specific data accessed, but it has the potential to expose sensitive information, compromising the confidentiality of the affected system.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
No specific workaround has been mentioned for this vulnerability.
Conclusion
The ethtool_get_wol function in the Linux kernel through version 4.7, as used in Android devices such as Nexus 5 and 7 (2013), suffers from an information disclosure vulnerability. Local users can exploit this vulnerability to access sensitive information. It is crucial to update the Linux kernel to a patched version provided by the respective Linux distribution or kernel maintainers. Regularly applying security updates and staying up to date with the latest software releases is essential for maintaining a secure system.
See every vulnerability recorded for linux →
FAQ
The vulnerability allows local users to obtain sensitive information, potentially compromising the confidentiality of the affected system.
This vulnerability has been observed in Nexus 5 and 7 (2013) devices running Android before 2016-08-05.
No, this vulnerability can only be exploited by local users.
Yes, this vulnerability has been assigned the CVE identifier CVE-2014-9900.
The CVSS score of this vulnerability is 5.5.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
