Description
The n_tty_write function in drivers/tty/n_tty.c in the Linux kernel through 3.14.3 does not properly manage tty driver access in the "LECHO & !OPOST" case, which allows local users to cause a denial of service (memory corruption and system crash) or gain privileges by triggering a race condition involving read and write operations with long strings.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.4-1 | — |
| Debian 13 | linux | 3.14.4-1 | — |
| Debian 12 | linux | 3.14.4-1 | — |
| Debian 7 | linux | 3.2.57-3+deb7u1 | DSA-2926-1 |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze6 | DSA-2928-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-24.47 | USN-2204-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.1.2.el7 | RHSA-2014:0678 |
| RHEL 6 | perf +15 | 2.6.32-358.6.1.el6 | RHSA-2013:0744 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.51.1.el6 | RHSA-2014:0520 |
| RHEL 6.3 EUS | perf +15 | 2.6.32-279.43.2.el6 | RHSA-2014:0512 |
| Red Hat MRG 2 | kernel-rt +10 | 3.10.33-rt32.34.el6rt | RHSA-2014:0557 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | kernel-source | 4.8.13-1.1 | openSUSE-SU-2024:10128-1 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | perf +11 | 3.10.0-123.1.2.el7 | ELSA-2014-0678 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel 3.14-rc1 < 3.15-rc4 (x64) - Raw Mode PTY Echo Race Condition Privilege Escalation EDB-33516 · local · May 26, 2014
GitHub 2 repositories
-
tempbottle/CVE-2014-0196 ★ 3 · Dec 17, 2014
CVE-2014-0196: Linux kernel pty layer race condition memory corruption
-
SunRain/CVE-2014-0196 ★ 0 · May 13, 2014
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 10
- RHSA-2014:0557 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2013:0744 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- RHSA-2014:0678 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0512 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0520 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2204-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2928-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-2926-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- openSUSE-SU-2024:10128-1 kernel-debug-4.8.13-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
- ELSA-2014-0678 Important: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 20, 2014
References
- USN-2203-1 vendor-advisory
- http://support.f5.com/kb/en-us/solutions/public/15000/300/sol15319.html
- 106646 vdb-entry
- SUSE-SU-2014:0683 vendor-advisory
- [oss-security] 20140429 CVE-2014-0196: Linux kernel pty layer race condition memory corruption mailing-list
- 59262 third-party-advisory
- USN-2204-1 vendor-advisory
- 59218 third-party-advisory
- USN-2202-1 vendor-advisory
- 33516 exploit
- DSA-2928 vendor-advisory
- USN-2199-1 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2014-0771.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1094232
- USN-2197-1 vendor-advisory
- http://source.android.com/security/bulletin/2016-07-01.html
- RHSA-2014:0512 vendor-advisory
- 59599 third-party-advisory
- DSA-2926 vendor-advisory
- https://github.com/torvalds/linux/commit/4291086b1f081b869c6d79e5b7441633dc3ace00
- SUSE-SU-2014:0667 vendor-advisory
- http://pastebin.com/raw.php?i=yTSFUBgZ
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4291086b1f081b869c6d79e5b7441633dc3ace00
- http://bugzilla.novell.com/show_bug.cgi?id=875690
- USN-2198-1 vendor-advisory
- USN-2200-1 vendor-advisory
- USN-2201-1 vendor-advisory
- USN-2196-1 vendor-advisory