CVE-2014-0038
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 35.5%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
The compat_sys_recvmmsg function in net/compat.c in the Linux kernel before 3.13.2, when CONFIG_X86_X32 is enabled, allows local users to gain privileges via a recvmmsg system call with a crafted timeout pointer parameter.
- CVSS 2.0
- 6.9 MEDIUMAV:L/AC:M/Au:N/C:C/I:C/A:C
- EPSS
- 35.45% probability · 98th percentile
- Public exploits
- 4 in Exploit-DB · verified · first 31 January 2014
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- linux/linux kernel · opensuse/opensuse
- Source
- secalert@redhat.com
EPSS 35.5% since 4 November 2026; no change recorded yet. The dashed line is the ten per cent mark our analysts treat as “patch before the next change window”. Points are recorded when the score first appears and whenever it moves by a percentage point or more.
Public exploits (4)
Entries in Exploit-DB that cite this CVE. Links go to the Exploit-DB page and to the file in the public repository; nothing is hosted here. A verified tick means the Exploit-DB team confirmed the exploit works against the stated version.
| EDB-ID | Title | Type | Published | Verified |
|---|---|---|---|---|
| EDB-40503source ↗ | Linux Kernel 3.13.1 - 'Recvmmsg' Local Privilege Escalation (Metasploit)linux · Metasploit | local | 11 October 2016 | yes |
| EDB-31347source ↗ | Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.04/13.10 x64) - 'CONFIG_X86_X32=y' Local Privilege Escalation (3)linux_x86-64 · rebel | local | 2 February 2014 | yes |
| EDB-31346source ↗ | Linux Kernel 3.4 < 3.13.2 (Ubuntu 13.10) - 'CONFIG_X86_X32' Arbitrary Write (2)linux · saelo | local | 2 February 2014 | yes |
| EDB-31305source ↗ | Linux Kernel 3.4 < 3.13.2 - recvmmsg x32 compat (PoC)linux · Kees Cook | dos | 31 January 2014 | no |
References
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlThird Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlThird Party Advisory, VDB Entry
- http://pastebin.com/raw.php?i=DH3Lbg54Exploit
- http://secunia.com/advisories/56669Not Applicable
- http://www.exploit-db.com/exploits/31346Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/31347Third Party Advisory, VDB Entry
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:038Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/01/31/2Mailing List
- http://www.securityfocus.com/bid/65255Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2094-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2095-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2096-1Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1060023Issue Tracking
- https://code.google.com/p/chromium/issues/detail?id=338594Third Party Advisory
- https://github.com/saelo/cve-2014-0038Third Party Advisory
- https://github.com/torvalds/linux/commit/2def2ef2ae5f3990aabdbe8a755911902707d268Exploit, Patch
- https://www.exploit-db.com/exploits/40503/Third Party Advisory, VDB Entry
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=2def2ef2ae5f3990aabdbe8a755911902707d268Third Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00002.htmlThird Party Advisory, VDB Entry
- http://lists.opensuse.org/opensuse-security-announce/2014-02/msg00003.htmlThird Party Advisory, VDB Entry
- http://pastebin.com/raw.php?i=DH3Lbg54Exploit
- http://secunia.com/advisories/56669Not Applicable
- http://www.exploit-db.com/exploits/31346Third Party Advisory, VDB Entry
- http://www.exploit-db.com/exploits/31347Third Party Advisory, VDB Entry
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.13.2Third Party Advisory
- http://www.mandriva.com/security/advisories?name=MDVSA-2014:038Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/01/31/2Mailing List
- http://www.securityfocus.com/bid/65255Third Party Advisory, VDB Entry
Source: NVD record, EPSS from FIRST.org, KEV from CISA, exploits from Exploit-DB. Refreshed daily. Download this record as JSON.