CVE-2014-6416

Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, allows remote attackers to cause a denial of service (memory corruption and panic) or possibly have unspecified other impact via a long unencrypted auth ticket.

• CWE-119

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
• http://tracker.ceph.com/issues/8979Broken Link
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Exploit, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/09/15/7Exploit, Mailing List
• http://www.securityfocus.com/bid/69805Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2376-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2377-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1142060Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8Exploit, Third Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
• http://tracker.ceph.com/issues/8979Broken Link
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Exploit, Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/09/15/7Exploit, Mailing List
• http://www.securityfocus.com/bid/69805Third Party Advisory, VDB Entry
• http://www.ubuntu.com/usn/USN-2376-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2377-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1142060Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8Exploit, Third Party Advisory

Published

Sep 28, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-6408Docker 1.3.0 through 1.3.1 allows remote attackers to modify…
• CVE-2014-6409Cross-site request forgery (CSRF) vulnerability in M/Monit 3…
• CVE-2014-6410The __udf_read_inode function in fs/udf/inode.c in the Linux…
• CVE-2014-6412WordPress before 4.4 makes it easier for remote attackers to…
• CVE-2014-6413A Cross-site Scripting (XSS) vulnerability exists in WatchGu…6.1
• CVE-2014-6414OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2…
• CVE-2014-6417net/ceph/auth_x.c in Ceph, as used in the Linux kernel befor…
• CVE-2014-6418net/ceph/auth_x.c in Ceph, as used in the Linux kernel befor…
• CVE-2014-6420Cross-site scripting (XSS) vulnerability in Livefyre LiveCom…6.1
• CVE-2014-6421Use-after-free vulnerability in the SDP dissector in Wiresha…
• CVE-2014-6422The SDP dissector in Wireshark 1.10.x before 1.10.10 creates…
• CVE-2014-6423The tvb_raw_text_add function in epan/dissectors/packet-mega…