Description
The rd_build_device_space function in drivers/target/target_core_rd.c in the Linux kernel before 3.14 does not properly initialize a certain data structure, which allows local users to obtain sensitive information from ramdisk_mcp memory by leveraging access to a SCSI initiator.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.2-1 | — |
| Debian 13 | linux | 3.14.2-1 | — |
| Debian 12 | linux | 3.14.2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-35.62 | USN-2337-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.13.1.el7 | RHSA-2014:1971 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat MRG 2 | kernel-rt +10 | 3.10.33-rt32.43.el6rt | RHSA-2014:0913 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-55.1.1.el6uek | 0.4.3-4.el6 | ELSA-2014-3103 |
| Oracle Linux 7 | dtrace-modules-3.8.13-55.1.1.el7uek | 0.4.3-4.el7 | ELSA-2014-3103 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-55.1.1.el7uek | ELSA-2014-3103 |
| Oracle Linux 7 | perf +11 | 3.10.0-123.13.1.el7 | ELSA-2014-1971 |
Advisories 5
- RHSA-2014:1971 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2337-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- RHSA-2014:0913 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2014-3103 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 11, 2014
- ELSA-2014-1971 Important: kernel security and bug fix update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 9, 2014
References
- SUSE-SU-2014:1316 vendor-advisory
- 59134 third-party-advisory
- https://support.f5.com/kb/en-us/solutions/public/15000/600/sol15685.html
- https://bugzilla.redhat.com/show_bug.cgi?id=1108744
- USN-2335-1 vendor-advisory
- USN-2334-1 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=4442dc8a92b8f9ad8ee9e7f8438f4c04c03a22dc
- SUSE-SU-2014:1319 vendor-advisory
- 60564 third-party-advisory
- https://github.com/torvalds/linux/commit/4442dc8a92b8f9ad8ee9e7f8438f4c04c03a22dc
- 59777 third-party-advisory
- 61310 third-party-advisory
- [oss-security] 20140611 Re: CVE request: Linux kernel / target information leak mailing-list
- [target-devel] 20140616 [PATCH] target: Explicitly clear ramdisk_mcp backend pages mailing-list