CVE-2014-7207

MEDIUM

Description

A certain Debian patch to the IPv6 implementation in the Linux kernel 3.2.x through 3.2.63 does not properly validate arguments in ipv6_select_ident function calls, which allows local users to cause a denial of service (NULL pointer dereference and system crash) by leveraging (1) tun or (2) macvtap device access.

References

http://www.debian.org/security/2014/dsa-3060

http://www.openwall.com/lists/oss-security/2014/11/02/1

http://www.securityfocus.com/bid/70867

http://www.ubuntu.com/usn/USN-2417-1

http://www.ubuntu.com/usn/USN-2418-1

https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=766195

Details

Source: MITRE

Published: 2014-11-10

Updated: 2014-12-24

Risk Information

CVSS v2.0

Base Score: 4.9

Vector: (AV:L/AC:L/Au:N/C:C/I:N/A:N)

Impact Score: 6.9

Exploitability Score: 3.9

Severity: MEDIUM