CVE-2014-3153
KEVLinux Kernel Privilege Escalation Vulnerability
Description
The futex_requeue function in kernel/futex.c in Linux kernel does not ensure that calls have two different futex addresses, which allows local users to gain privileges.
The futex_requeue function in kernel/futex.c in the Linux kernel through 3.14.5 does not ensure that calls have two different futex addresses, which allows local users to gain privileges via a crafted FUTEX_REQUEUE command that facilitates unsafe waiter modification.
CVSS 3.1 vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HPublishedJun 7, 2014
Last modifiedJun 17, 2026
Added to KEVMay 25, 2022
Remediation dueJun 15, 2022
References
- git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=e9c243a5a6de0be8e584c604d353412584b592f8Broken Link
- linux.oracle.com/errata/ELSA-2014-0771.htmlThird Party Advisory
- linux.oracle.com/errata/ELSA-2014-3037.htmlThird Party Advisory
- linux.oracle.com/errata/ELSA-2014-3038.htmlThird Party Advisory
- linux.oracle.com/errata/ELSA-2014-3039.htmlThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-06/msg00014.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-06/msg00018.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-06/msg00025.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-07/msg00006.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-10/msg00006.htmlMailing ListThird Party Advisory
- lists.opensuse.org/opensuse-security-announce/2014-10/msg00007.htmlMailing ListThird Party Advisory
- openwall.com/lists/oss-security/2014/06/05/24Mailing List
0 recent articles mention this CVE
73
Risk assessment · High
Actively exploited. Patch immediately.
- Exploitation
- Confirmed in the wild (CISA KEV)
- Federal remediation deadline
- Overdue by 1595 days
- CVSS
- 7.8 HIGH
- EPSS (30-day exploit probability)
- 37.2% · top 1% of all CVEs
- Weakness
- NVD-CWE-noinfo
Recommended actions
- 1.Apply updates per vendor instructions.
- 2.Treat as emergency change: patch or isolate internet-facing instances first.
- 3.Hunt for compromise: review logs for the disclosure window, not just from the patch date.
Assessment is derived automatically from the live signals above; verify against your own asset inventory.