Description
The Linux kernel before 3.15.4 on Intel processors does not properly restrict use of a non-canonical value for the saved RIP address in the case of a system call that does not use IRET, which allows local users to leverage a race condition and gain privileges, or cause a denial of service (double fault), via a crafted application that makes ptrace and fork system calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.10-1 | — |
| Debian 13 | linux | 3.14.10-1 | — |
| Debian 12 | linux | 3.14.10-1 | — |
| Debian 7 | linux | 3.2.60-1+deb7u1 | DSA-2972-1 |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze8 | DLA-0015-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-30.55 | USN-2274-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.4.4.el7 | RHSA-2014:0923 |
| RHEL 6 | perf +16 | 2.6.32-431.20.5.el6 | RHSA-2014:0924 |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.53.1.el6 | RHSA-2014:0949 |
| RHEL 6.4 EUS | perf +15 | 2.6.32-358.46.2.el6 | RHSA-2014:0925 |
| Red Hat MRG 2 | kernel-rt +10 | 3.10.33-rt32.43.el6rt | RHSA-2014:0913 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-35.3.2.el7uek | 0.4.3-4.el7 | ELSA-2014-3049 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-35.3.2.el7uek | ELSA-2014-3049 |
| Oracle Linux 7 | perf +11 | 3.10.0-123.4.4.el7 | ELSA-2014-0923 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel < 3.2.0-23 (Ubuntu 12.04 x64) - 'ptrace/sysret' Local Privilege Escalation EDB-34134 · local · Jul 21, 2014
GitHub 1 repository
-
vnik5287/cve-2014-4699-ptrace ★ 1 · Jul 23, 2019
My old sysret / ptrace PoC
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 10
- RHSA-2014:0923 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0925 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0924 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0949 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2274-1 linux vulnerability Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2972-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-0015-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- RHSA-2014:0913 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Nov 22, 2025
- ELSA-2014-3049 Important: unbreakable enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
- ELSA-2014-0923 Important: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- http://linux.oracle.com/errata/ELSA-2014-3047.html
- USN-2269-1 vendor-advisory
- USN-2274-1 vendor-advisory
- USN-2268-1 vendor-advisory
- USN-2267-1 vendor-advisory
- 108754 vdb-entry
- 60220 third-party-advisory
- [oss-security] 20140704 CVE-2014-4699: Linux ptrace bug mailing-list
- USN-2271-1 vendor-advisory
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.14.11
- 59654 third-party-advisory
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.4.97
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.10.47
- USN-2266-1 vendor-advisory
- [oss-security] 20140708 Re: CVE-2014-4699: Linux ptrace bug mailing-list
- [oss-security] 20140708 Re: CVE-2014-4699: Linux ptrace bug mailing-list
- 59633 third-party-advisory
- http://packetstormsecurity.com/files/127573/Linux-Kernel-ptrace-sysret-Local-Privilege-Escalation.html
- http://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.15.4
- http://linux.oracle.com/errata/ELSA-2014-0924.html
- [oss-security] 20140705 Re: CVE-2014-4699: Linux ptrace bug mailing-list
- 60393 third-party-advisory
- 60380 third-party-advisory
- USN-2270-1 vendor-advisory
- http://linux.oracle.com/errata/ELSA-2014-3048.html
- 34134 exploit
- 59639 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a
- USN-2273-1 vendor-advisory
- USN-2272-1 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1115927
- DSA-2972 vendor-advisory
- https://github.com/torvalds/linux/commit/b9cd18de4db3c9ffa7e17b0dc0ca99ed5aa4d43a