CVE-2014-6417

net/ceph/auth_x.c in Ceph, as used in the Linux kernel before 3.16.3, does not properly consider the possibility of kmalloc failure, which allows remote attackers to cause a denial of service (system crash) or possibly have unspecified other impact via a long unencrypted auth ticket.

• CWE-399

• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
• http://tracker.ceph.com/issues/8979Vendor Advisory
• http://tracker.ceph.com/issues/9560Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/09/15/7Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2376-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2377-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1142072Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8Exploit, Third Party Advisory
• http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=c27a3e4d667fdcad3db7b104f75659478e0c68d8
• http://tracker.ceph.com/issues/8979Vendor Advisory
• http://tracker.ceph.com/issues/9560Vendor Advisory
• http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.16.3Vendor Advisory
• http://www.openwall.com/lists/oss-security/2014/09/15/7Mailing List, Third Party Advisory
• http://www.ubuntu.com/usn/USN-2376-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2377-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2378-1Third Party Advisory
• http://www.ubuntu.com/usn/USN-2379-1Third Party Advisory
• https://bugzilla.redhat.com/show_bug.cgi?id=1142072Issue Tracking, Third Party Advisory
• https://github.com/torvalds/linux/commit/c27a3e4d667fdcad3db7b104f75659478e0c68d8Exploit, Third Party Advisory

Published

Sep 28, 2014

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2014-6409Cross-site request forgery (CSRF) vulnerability in M/Monit 3…
• CVE-2014-6410The __udf_read_inode function in fs/udf/inode.c in the Linux…
• CVE-2014-6412WordPress before 4.4 makes it easier for remote attackers to…
• CVE-2014-6413A Cross-site Scripting (XSS) vulnerability exists in WatchGu…6.1
• CVE-2014-6414OpenStack Neutron before 2014.2.4 and 2014.1 before 2014.1.2…
• CVE-2014-6416Buffer overflow in net/ceph/auth_x.c in Ceph, as used in the…
• CVE-2014-6418net/ceph/auth_x.c in Ceph, as used in the Linux kernel befor…
• CVE-2014-6420Cross-site scripting (XSS) vulnerability in Livefyre LiveCom…6.1
• CVE-2014-6421Use-after-free vulnerability in the SDP dissector in Wiresha…
• CVE-2014-6422The SDP dissector in Wireshark 1.10.x before 1.10.10 creates…
• CVE-2014-6423The tvb_raw_text_add function in epan/dissectors/packet-mega…
• CVE-2014-6424The dissect_v9_v10_pdu_data function in epan/dissectors/pack…