CVE-2014-9114 Command injection in n/a

High 7.8 Published 31 Mar 2017 Updated 4 Dec 2025

Local attackers can execute arbitrary code via a vulnerability in the blkid utility of util-linux, requiring an upgrade to mitigate.

Exploited in the wild: Not known
Login needed: Any signed-in user
Attackable: Local or same network only
Victim action needed: Not needed
Fix: Available

What is CVE-2014-9114?

CVE-2014-9114 is a high-severity command injection vulnerability in Fedoraproject Fedora, published on 31 Mar 2017. It can only be exploited from the same machine or local network, with no action from the victim.

Official description

Blkid in util-linux before 2.26rc-1 allows local users to execute arbitrary code.

Weakness: CWE-77

Which versions are affected by CVE-2014-9114?

It affects 3 products.

Linux distribution packages (11)

`python-libmount` SUSE:Linux Enterprise Desktop 12	All versions	`2.25-10.3`
`util-linux` SUSE:Linux Enterprise Desktop 12	All versions	`2.25-10.1`
`util-linux-systemd` SUSE:Linux Enterprise Desktop 12	All versions	`2.25-10.1`
`python-libmount` SUSE:Linux Enterprise Server 12	All versions	`2.25-10.3`
`util-linux` SUSE:Linux Enterprise Server 12	All versions	`2.25-10.1`
`util-linux-systemd` SUSE:Linux Enterprise Server 12	All versions	`2.25-10.1`
`python-libmount` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`2.25-10.3`
`util-linux` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`2.25-10.1`
`util-linux-systemd` SUSE:Linux Enterprise Server for SAP Applications 12	All versions	`2.25-10.1`
`util-linux` SUSE:Linux Enterprise Software Development Kit 12	All versions	`2.25-10.1`
`util-linux` SUSE:Linux Enterprise Workstation Extension 12	All versions	`2.25-10.1`

Products include Fedoraproject Fedora, Kernel Util-Linux, Opensuse Opensuse.

How do I fix CVE-2014-9114?

Upgrade to a fixed version.

Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.

Is CVE-2014-9114 being exploited?

It is not confirmed as exploited in the wild, but public exploit code for CVE-2014-9114 exists.

All Fedoraproject Fedora vulnerabilities

Sources

Also known as DEBIAN-CVE-2014-9114, GHSA-g7m2-8cqp-hf7v, MGASA-2014-0517, SUSE-SU-2015:0270-1, SUSE-SU-2015:0580-1, UBUNTU-CVE-2014-9114.