CVE-2014-2678 Null dereference in n/a
Local attackers can crash the Linux kernel via a NULL pointer dereference in the RDS module when binding sockets on systems without RDS transports.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Local or same network only
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-2678?
CVE-2014-2678 is a medium-severity vulnerability in Fedoraproject Fedora, published on 1 Apr 2014. It can only be exploited from the same machine or local network, with no action from the victim.
Official description
The rds_iw_laddr_check function in net/rds/iw.c in the Linux kernel through 3.14 allows local users to cause a denial of service (NULL pointer dereference and system crash) or possibly have unspecified other impact via a bind system call for an RDS socket on a system that lacks RDS transports.
Weakness: CWE-476
Which versions are affected by CVE-2014-2678?
It affects 3 products.
Products include Fedoraproject Fedora, Linux kernel, Oracle Linux.
How do I fix CVE-2014-2678?
Apply the vendor's patch.
Is CVE-2014-2678 being exploited?
There is no known exploitation of CVE-2014-2678 in the wild and no public exploit code.
Other vulnerabilities in Fedoraproject Fedora
Sources
Also known as DEBIAN-CVE-2014-2678, GHSA-m6m4-ppmj-ppv3.