Sensitive Information Disclosure in Linux Kernel - CVE-2014-9900
Summary
DEBIAN-CVE-2014-9900: The ethtool_get_wol function in net/core/ethtool.c in the Linux kernel through 4.7, as used in Android before 2016-08-05 on Nexus 5 and 7 (2013) devices, does not initialize a certain data structure, which allows local u... Affects linux versions 5.10.103-1 – 6.9.9-1. No fix is published. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Linux kernel is a core component of the operating system that manages hardware and system resources. It provides essential services for all other parts of the operating system and is widely used across various devices, including servers, desktops, and mobile devices. This vulnerability affects the ethtool_get_wol function, which is responsible for managing Wake-on-LAN settings, and can lead to unauthorized access to sensitive information.
Vulnerability Detail
CVE-2014-9900 is a vulnerability in the Linux kernel that arises from the ethtool_get_wol function not properly initializing a data structure. This flaw allows local users to exploit the vulnerability through crafted applications, potentially leading to the disclosure of sensitive information. The issue has been identified in the Linux kernel versions up to 4.7 and affects Android devices, specifically Nexus 5 and 7 (2013) models, prior to August 5, 2016.
How To Fix
No fixed version is published for this vulnerability.
Tip — Not sure whether your app is affected? Vulert can check the versions your app actually runs. Scan free →
Workaround
As a workaround, users can limit access to the affected functionality by restricting permissions for local users or by disabling Wake-on-LAN features if they are not needed. This can be done through system settings or configuration files, depending on the specific environment.
Conclusion
CVE-2014-9900 is a significant vulnerability in the Linux kernel that can lead to sensitive information disclosure. It is crucial for users to update their systems to the latest patched versions to protect against potential exploitation. Additionally, utilizing tools like Vulert can help monitor and manage vulnerabilities effectively.
See every vulnerability recorded for linux →
FAQ
CVE-2014-9900 is a vulnerability in the Linux kernel that allows local users to obtain sensitive information due to improper initialization of a data structure in the ethtool_get_wol function.
The vulnerability affects Linux kernel versions up to 4.7.
You can use tools like Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability can lead to unauthorized access to sensitive information, which may compromise user privacy and system security.
Yes, a patch is available. Users should update their Linux package to a version above 4.7 to mitigate the vulnerability.
References
Related vulnerabilities
Recent vulnerabilities recorded for linux.
