Description
The PPPoL2TP feature in net/l2tp/l2tp_ppp.c in the Linux kernel through 3.15.6 allows local users to gain privileges by leveraging data-structure differences between an l2tp socket and an inet socket.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.14.13-1 | — |
| Debian 13 | linux | 3.14.13-1 | — |
| Debian 12 | linux | 3.14.13-1 | — |
| Debian 7 | linux | 3.2.60-1+deb7u3 | DSA-2992-1 |
| Debian 6.0 | linux-2.6 | 2.6.32-48squeeze9 | DLA-103-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-32.57 | USN-2290-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.4.4.el7 | RHSA-2014:0923 |
| RHEL 6 | perf +16 | 2.6.32-431.20.5.el6 | RHSA-2014:0924 |
Show 2 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.54.1.el6 | RHSA-2014:1025 |
| RHEL 6.4 EUS | perf +15 | 2.6.32-358.46.2.el6 | RHSA-2014:0925 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-35.3.2.el7uek | 0.4.3-4.el7 | ELSA-2014-3049 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-35.3.2.el7uek | ELSA-2014-3049 |
| Oracle Linux 7 | perf +11 | 3.10.0-123.4.4.el7 | ELSA-2014-0923 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linux Kernel 3.15.6 - PPP-over-L2TP Socket Level Handling Crash (PoC) EDB-36267 · dos · Mar 4, 2015
GitHub 1 repository
-
redes-2015/l2tp-socket-bug ★ 5 · Nov 22, 2015
Estudo e apresentação do bug CVE-2014-4943 para a disciplina MAC0448
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 9
- RHSA-2014:0923 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0925 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:0924 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- RHSA-2014:1025 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 26, 2026
- USN-2290-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- DSA-2992-1 linux - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-103-1 linux-2.6 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- ELSA-2014-3049 Important: unbreakable enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
- ELSA-2014-0923 Important: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Jul 23, 2014
References
- 36267 exploit
- http://linux.oracle.com/errata/ELSA-2014-3047.html
- SUSE-SU-2014:1316 vendor-advisory
- 1030610 vdb-entry
- 60220 third-party-advisory
- 59790 third-party-advisory
- RHSA-2014:1025 vendor-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
- SUSE-SU-2014:1319 vendor-advisory
- SUSE-SU-2015:0481 vendor-advisory
- openSUSE-SU-2015:0566 vendor-advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1119458
- http://linux.oracle.com/errata/ELSA-2014-0924.html
- 60393 third-party-advisory
- 60380 third-party-advisory
- http://linux.oracle.com/errata/ELSA-2014-3048.html
- linux-kernel-cve20144943-priv-esc(94665) vdb-entry
- [oss-security] 20140716 CVE-2014-4943: Linux privilege escalation in ppp over l2tp sockets mailing-list
- 60011 third-party-advisory
- https://github.com/torvalds/linux/commit/3cf521f7dc87c031617fd47e4b7aa2593c2f3daf
- DSA-2992 vendor-advisory
- 109277 vdb-entry
- 60071 third-party-advisory