What is the CVSS score of CVE-2014-9644?

CVE-2014-9644 has a CVSS 2.0 base score of 2.1 (Low). CVSS vector: AV:L/AC:L/Au:N/C:N/I:P/A:N. EPSS exploitation probability: 0.1%.

Is there a patch available for CVE-2014-9644?

Yes, a patch is available for CVE-2014-9644. Update the affected software to the latest version immediately.

Debian Linux CVE-2014-9644

LOW

Improper Privilege Management (CWE-269)

2015-03-02 cve@mitre.org

Privilege Escalation Linux Debian Oracle Canonical Debian Linux Linux Kernel Ubuntu Linux

2.1

CVSS 2.0 · NVD

Severity by source

NVD PRIMARY

2.1 LOW

AV:L/AC:L/Au:N/C:N/I:P/A:N

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

Attack Vector

Local

Attack Complexity

Low

Confidentiality

None

Integrity

Availability

None

Lifecycle Timeline

CVE Published

Mar 02, 2015 - 11:59 cve.org

LOW 2.1

DescriptionCVE.org

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421.

AnalysisAI

The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the. Rated low severity (CVSS 2.1), this vulnerability is low attack complexity. This Improper Privilege Management vulnerability could allow attackers to escalate privileges to gain unauthorized elevated access.

Technical ContextAI

This vulnerability is classified as Improper Privilege Management (CWE-269), which allows attackers to escalate privileges to gain unauthorized elevated access. The Crypto API in the Linux kernel before 3.18.5 allows local users to load arbitrary kernel modules via a bind system call for an AF_ALG socket with a parenthesized module template expression in the salg_name field, as demonstrated by the vfat(aes) expression, a different vulnerability than CVE-2013-7421. Affected products include: Linux Linux Kernel, Debian Debian Linux, Canonical Ubuntu Linux, Oracle Linux. Version information: before 3.18.5.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Apply principle of least privilege, validate privilege transitions, implement proper role separation.