CVE-2014-9748 Race condition in n/a
Attackers can cause a denial of service via deadlock in libuv's Windows XP/2003 lock implementation due to a race condition.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-9748?
CVE-2014-9748 is a high-severity vulnerability in Nodejs Node.js, published on 11 Feb 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The uv_rwlock_t fallback implementation for Windows XP and Server 2003 in libuv before 1.7.4 does not properly prevent threads from releasing the locks of other threads, which allows attackers to cause a denial of service (deadlock) or possibly have unspecified other impact by leveraging a race condition.
Weakness: CWE-362
Which versions are affected by CVE-2014-9748?
It affects 2 products.
Products include Libuv Libuv, Nodejs Node.js.
How do I fix CVE-2014-9748?
Upgrade to a fixed version.
Is CVE-2014-9748 being exploited?
There is no known exploitation of CVE-2014-9748 in the wild and no public exploit code.
Other vulnerabilities in Nodejs Node.js
Sources
Also known as DEBIAN-CVE-2014-9748, GHSA-6w8h-9vfj-7934.