CVE - CVE-2014-9645

CVE-ID
CVE-2014-9645	Learn more at National Vulnerability Database (NVD) • CVSS Severity Rating • Fix Information • Vulnerable Software Versions • SCAP Mappings • CPE Information
Description
The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.
References
Note: References are provided for the convenience of the reader to help distinguish between vulnerabilities. The list is not intended to be complete.
BID:72324 URL:http://www.securityfocus.com/bid/72324 CONFIRM:http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b CONFIRM:https://bugs.busybox.net/show_bug.cgi?id=7652 CONFIRM:https://bugzilla.redhat.com/show_bug.cgi?id=1185707 FULLDISC:20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client URL:http://seclists.org/fulldisclosure/2020/Mar/15 GENTOO:GLSA-201503-13 URL:https://security.gentoo.org/glsa/201503-13 MISC:https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu MLIST:[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update URL:https://lists.debian.org/debian-lts-announce/2018/07/msg00037.html MLIST:[oss-security] 20150124 Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load URL:http://openwall.com/lists/oss-security/2015/01/24/4 UBUNTU:USN-3935-1 URL:https://usn.ubuntu.com/3935-1/
Assigning CNA
MITRE Corporation
Date Record Created
20150124	Disclaimer: The record creation date may reflect when the CVE ID was allocated or reserved, and does not necessarily indicate when this vulnerability was discovered, shared with the affected vendor, publicly disclosed, or updated in CVE.
Phase (Legacy)
Assigned (20150124)
Votes (Legacy)

Comments (Legacy)

Proposed (Legacy)
N/A
This is an record on the CVE List, which provides common identifiers for publicly known cybersecurity vulnerabilities.
Search CVE Using Keywords: You can also search by reference using the CVE Reference Maps.
For More Information: CVE Request Web Form (select "Other" from dropdown)