Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
2.9
CVE-2014-2568: Linux kernel upgrade may let attackers read private memory
CVE-2014-2568 · published 12 years ago
Summary
A flaw in older Linux kernel versions (up to 3.13.6) could let a remote attacker trick the system into revealing data stored in the core of the operating system. This happens because the code fails to correctly clean up after handling certain network packets. Updating the kernel to a newer version that includes the fix removes the risk.
What to do
- Update debian linux to version 3.13.7-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Debian:12 | debian | linux |
< 3.13.7-1 Fix: upgrade to 3.13.7-1
|
| Debian:13 | debian | linux |
< 3.13.7-1 Fix: upgrade to 3.13.7-1
|
| Debian:14 | debian | linux |
< 3.13.7-1 Fix: upgrade to 3.13.7-1
|
| – | linux | linux_kernel |
>= 3.0, <= 3.13.6 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
| – | canonical | ubuntu_linux |
14.04 cpe:2.3:o:canonical:ubuntu_linux:14.04:*:*:*:lts:*:*:* |
Original advisory text
Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memo...
Use-after-free vulnerability in the nfqnl_zcopy function in net/netfilter/nfnetlink_queue_core.c in the Linux kernel through 3.13.6 allows attackers to obtain sensitive information from kernel memory by leveraging the absence of a certain orphaning operation. NOTE: the affected code was moved to the skb_zerocopy function in net/core/skbuff.c before the vulnerability was announced.
References
- https://security-tracker.debian.org/tracker/CVE-2014-2568 Vendor Advisory
- http://seclists.org/oss-sec/2014/q1/627 Mailing List Third Party Advisory
- http://secunia.com/advisories/59599 Broken Link
- http://www.openwall.com/lists/oss-security/2014/03/20/16 Mailing List Patch Third Party Advisory
- http://www.securityfocus.com/bid/66348 Third Party Advisory VDB Entry
- http://www.ubuntu.com/usn/USN-2240-1 Third Party Advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1079012 Issue Tracking Third Party Advisory
- https://exchange.xforce.ibmcloud.com/vulnerabilities/91922 Third Party Advisory VDB Entry
- https://lkml.org/lkml/2014/3/20/421 Exploit Third Party Advisory
Severity
2.9
Low
Type
CWE-416Use After Free
Timeline
Published24 Mar 2014
Updated31 Oct 2026
First seen1 Sep 2026
Track software like this
Free during beta