CVE-2014-4608
HIGHCVSS 7.3/10EPSS 5.42%
Last modified
CVE-2014-4608 is a high-severity vulnerability rated 7.3/10 on the CVSS scale. Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.. EPSS estimates a 5.42% chance of exploitation in the next 30 days.
Description
Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.
Metrics
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
Weakness Enumeration
Affected Software
| Vendor | Product | Versions | Update |
|---|---|---|---|
| Linux | Linux Kernel | < 3.15.2 | — |
| Opensuse | Opensuse | 11.4 | — |
| Suse | Linux Enterprise Real Time Extension | 11 | Sp3 |
| Suse | Linux Enterprise Server | 11 | Sp2 |
| Canonical | Ubuntu Linux | 10.04 | — |
| Canonical | Ubuntu Linux | 12.04 | — |
| Canonical | Ubuntu Linux | 14.04 | — |
| Canonical | Ubuntu Linux | 14.10 | — |
References
- http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0062.htmlThird Party Advisory
- http://secunia.com/advisories/60011Third Party Advisory
- http://secunia.com/advisories/60174Third Party Advisory
- http://secunia.com/advisories/62633Third Party Advisory
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2Release Notes, Vendor Advisory
- http://www.oberhumer.com/opensource/lzo/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/06/26/21Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/68214Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2416-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2417-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2418-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2419-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2420-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2421-1Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1113899Issue Tracking, Third Party Advisory
- https://github.com/torvalds/linux/commit/206a81c18401c0cde6e579164f752c4b147324cePatch, Third Party Advisory
- http://blog.securitymouse.com/2014/06/raising-lazarus-20-year-old-bug-that.htmlThird Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00010.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-03/msg00025.htmlMailing List, Third Party Advisory
- http://lists.opensuse.org/opensuse-security-announce/2015-04/msg00015.htmlMailing List, Third Party Advisory
- http://rhn.redhat.com/errata/RHSA-2015-0062.htmlThird Party Advisory
- http://secunia.com/advisories/60011Third Party Advisory
- http://secunia.com/advisories/60174Third Party Advisory
- http://secunia.com/advisories/62633Third Party Advisory
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.2Release Notes, Vendor Advisory
- http://www.oberhumer.com/opensource/lzo/Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/06/26/21Mailing List, Third Party Advisory
- http://www.securityfocus.com/bid/68214Third Party Advisory, VDB Entry
- http://www.ubuntu.com/usn/USN-2416-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2417-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2418-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2419-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2420-1Third Party Advisory
- http://www.ubuntu.com/usn/USN-2421-1Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1113899Issue Tracking, Third Party Advisory
- https://github.com/torvalds/linux/commit/206a81c18401c0cde6e579164f752c4b147324cePatch, Third Party Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2014-4608?
Multiple integer overflows in the lzo1x_decompress_safe function in lib/lzo/lzo1x_decompress_safe.c in the LZO decompressor in the Linux kernel before 3.15.2 allow context-dependent attackers to cause a denial of service (memory corruption) via a crafted Literal Run. NOTE: the author of the LZO algorithms says "the Linux kernel is *not* affected; media hype.
How severe is CVE-2014-4608?
CVE-2014-4608 has a CVSS score of 7.3/10 (HIGH severity). The EPSS model estimates a 5.42% probability of exploitation in the next 30 days.
How do I fix CVE-2014-4608?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
Are you affected by CVE-2014-4608?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST