Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
4.7
CVE-2014-6410: Linux kernel UDF support can crash system
CVE-2014-6410 · published 12 years ago
Summary
The Linux kernel versions up to 3.16.3 mishandle a special UDF file system structure, allowing a nearby attacker to create a malformed disk image that can freeze or crash the machine. This happens because the code does not limit how deep it follows certain pointers, leading to an endless loop or excessive memory use. Upgrade the kernel to a version that includes the fix or avoid mounting untrusted UDF media.
What to do
- Update canonical linux to version 3.13.0-37.64.
- Update debian linux to version 3.16.5-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| Ubuntu:14.04:LTS | canonical | linux |
< 3.13.0-37.64 Fix: upgrade to 3.13.0-37.64
|
| Ubuntu:18.04:LTS | canonical | linux-azure | All versions |
| Ubuntu:18.04:LTS | canonical | linux-gcp | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe | All versions |
| Ubuntu:18.04:LTS | canonical | linux-hwe-edge | All versions |
| Ubuntu:20.04:LTS | canonical | linux-azure-fde | All versions |
| Ubuntu:Pro:20.04:LTS | canonical | linux-azure-fde-5.15 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gke | All versions |
| Ubuntu:20.04:LTS | canonical | linux-gkeop | All versions |
| Ubuntu:20.04:LTS | canonical | linux-raspi2 | All versions |
| Ubuntu:20.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:22.04:LTS | canonical | linux-intel-iot-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:22.04:LTS | canonical | linux-riscv | All versions |
| Ubuntu:24.04:LTS | canonical | linux-azure-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-gcp-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-lowlatency-hwe-6.11 | All versions |
| Ubuntu:24.04:LTS | canonical | linux-raspi-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-realtime | All versions |
| Ubuntu:24.04:LTS | canonical | linux-riscv | All versions |
| Debian:12 | debian | linux |
< 3.16.5-1 Fix: upgrade to 3.16.5-1
|
| Debian:13 | debian | linux |
< 3.16.5-1 Fix: upgrade to 3.16.5-1
|
| Debian:14 | debian | linux |
< 3.16.5-1 Fix: upgrade to 3.16.5-1
|
| – | linux | linux_kernel |
<= 3.16.3 3.16.0 3.16.1 3.16.2 cpe:2.3:o:linux:linux_kernel:*:*:*:*:*:*:*:* |
Original advisory text
The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of ...
The __udf_read_inode function in fs/udf/inode.c in the Linux kernel through 3.16.3 does not restrict the amount of ICB indirection, which allows physically proximate attackers to cause a denial of service (infinite loop or stack consumption) via a UDF filesystem with a crafted inode.
References
- https://security-tracker.debian.org/tracker/CVE-2014-6410 Vendor Advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=...
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.html
- http://lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.html
- http://marc.info/?l=bugtraq&m=142722450701342&w=2
- http://marc.info/?l=bugtraq&m=142722544401658&w=2
- http://rhn.redhat.com/errata/RHSA-2014-1318.html
- http://www.securityfocus.com/bid/69799
- http://www.ubuntu.com/usn/USN-2374-1
- http://www.ubuntu.com/usn/USN-2375-1
- http://www.ubuntu.com/usn/USN-2376-1
- http://www.ubuntu.com/usn/USN-2377-1
- http://www.ubuntu.com/usn/USN-2378-1
- http://www.ubuntu.com/usn/USN-2379-1
- https://bugzilla.redhat.com/show_bug.cgi?id=1141809
- https://github.com/torvalds/linux/commit/c03aa9f6e1f938618e6db2e23afef0574efeeb6... Exploit
- https://ubuntu.com/security/CVE-2014-6410 Third Party Advisory
- http://www.openwall.com/lists/oss-security/2014/09/15/9 Third Party Advisory
- https://ubuntu.com/security/notices/USN-2374-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2375-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2376-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2377-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2378-1 Vendor Advisory
- https://ubuntu.com/security/notices/USN-2379-1 Vendor Advisory
- https://www.cve.org/CVERecord?id=CVE-2014-6410 Third Party Advisory
Severity
4.7
Medium
Type
CWE-399Resource Management Errors
Timeline
Published28 Sep 2014
Updated4 Nov 2026
First seen12 May 2026
Track software like this
Free during beta