CVE-2014-3180

Vulnerability

In the Linux kernel before version 3.17, the file kernel/compat.c contains a potential out-of-bounds read vulnerability. The function restart_syscall uses uninitialized data when restarting the compat_sys_nanosleep system call. This issue is disputed because the code path is considered unreachable under normal operation.

Exploitation

The code path required to trigger this vulnerability is disputed as unreachable. No known exploitation scenario exists, as the specific conditions for the restart of compat_sys_nanosleep with uninitialized data are not achievable in practice.

Impact

If the code path were reachable, an attacker could cause an out-of-bounds read, potentially leading to information disclosure. However, due to the disputed nature of the reachability, the practical impact is considered negligible.

Mitigation

The vulnerability is fixed in Linux kernel version 3.17 and later. No workaround is necessary as the code path is unreachable. This CVE is not listed on the CISA Known Exploited Vulnerabilities (KEV) catalog.