Description
arch/x86/kernel/entry_64.S in the Linux kernel before 3.17.5 does not properly handle faults associated with the Stack Segment (SS) segment register, which allows local users to gain privileges by triggering an IRET instruction that leads to access to a GS Base address from the wrong space.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | linux | 3.16.7-ckt2-1 | — |
| Debian 13 | linux | 3.16.7-ckt2-1 | — |
| Debian 12 | linux | 3.16.7-ckt2-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 14.04 LTS | linux | 3.13.0-43.72 | USN-2446-1 |
| Ubuntu 14.04 LTS | linux-lts-utopic | 3.16.0-28.37~14.04.1 | USN-2447-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 7 | perf +17 | 3.10.0-123.13.2.el7 | RHSA-2014:2010 |
| RHEL 6 | perf +16 | 2.6.32-504.3.3.el6 | RHSA-2014:1997 |
| RHEL 5 | kernel +12 | 2.6.18-400.1.1.el5 | RHSA-2014:2008 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Rhel Mission Critical 6 | perf +9 | 2.6.32-220.57.1.el6 | RHSA-2014:2028 |
| Red Hat Rhel Mission Critical 5 | kernel +10 | 2.6.18-238.54.1.el5 | RHSA-2014:2031 |
| RHEL 6.5 EUS | perf +16 | 2.6.32-431.40.2.el6 | RHSA-2014:2009 |
| RHEL 6.4 EUS | perf +15 | 2.6.32-358.51.2.el6 | RHSA-2014:2030 |
| RHEL 5.9 EUS | kernel +12 | 2.6.18-348.29.1.el5 | RHSA-2014:2029 |
| RHEL 4 ELS | kernel +10 | 2.6.9-106.EL | RHSA-2015:0009 |
| Red Hat MRG 2 | kernel-rt +10 | 3.10.58-rt62.60.el6rt | RHSA-2014:1998 |
Oracle Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Oracle Linux 7 | dtrace-modules-3.8.13-55.1.2.el6uek | 0.4.3-4.el6 | ELSA-2014-3106 |
| Oracle Linux 7 | dtrace-modules-3.8.13-55.1.2.el7uek | 0.4.3-4.el7 | ELSA-2014-3106 |
| Oracle Linux 7 | kernel-uek +5 | 3.8.13-55.1.2.el7uek | ELSA-2014-3106 |
| Oracle Linux 7 | perf +11 | 3.10.0-123.13.2.el7 | ELSA-2014-2010 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 2
- Linux Kernel - 'BadIRET' Local Privilege Escalation EDB-44205 · local · Jul 24, 2017
- Linux Kernel 3.17.5 - IRET Instruction #SS Fault Handling Crash (PoC) EDB-36266 · dos · Mar 4, 2015
GitHub 1 repository
-
RKX1209/CVE-2014-9322 ★ 8 · Jul 19, 2017
CVE-2014-9322 (a.k.a BadIRET) proof of concept for Linux
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Advisories 14
- RHSA-2015:0009 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2030 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2031 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2028 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2029 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2009 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2010 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:1998 Red Hat Security Advisory: kernel-rt security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:2008 Red Hat Security Advisory: kernel security update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- RHSA-2014:1997 Red Hat Security Advisory: kernel security and bug fix update Red Hat Security Advisories (RHSA) · Jun 27, 2026
- USN-2446-1 linux vulnerabilities Ubuntu Security Notices (USN) · Apr 22, 2026
- USN-2447-1 linux-lts-utopic vulnerabilities Ubuntu Security Notices (USN) · Feb 10, 2026
- ELSA-2014-3106 Important: Unbreakable Enterprise kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 19, 2014
- ELSA-2014-2010 Important: kernel security update (Oracle Linux 7) Oracle Linux Security Advisories (ELSA) · Dec 18, 2014
References
- USN-2491-1 vendor-advisory
- HPSBGN03285 vendor-advisory
- SUSE-SU-2015:0736 vendor-advisory
- https://www.kernel.org/pub/linux/kernel/v3.x/ChangeLog-3.17.5
- https://bugzilla.redhat.com/show_bug.cgi?id=1172806
- RHSA-2015:0009 vendor-advisory
- HPSBGN03282 vendor-advisory
- https://help.joyent.com/entries/98788667-Security-Advisory-ZDI-CAN-3263-ZDI-CAN-3284-and-ZDI-CAN-3364-Vulnerabilities
- http://www.zerodayinitiative.com/advisories/ZDI-16-170
- openSUSE-SU-2015:0566 vendor-advisory
- RHSA-2014:2008 vendor-advisory
- https://github.com/torvalds/linux/commit/6f442be2fb22be02cafa606f1769fa1e6f894441
- 62336 third-party-advisory
- http://git.kernel.org/?p=linux/kernel/git/torvalds/linux-2.6.git%3Ba=commit%3Bh=6f442be2fb22be02cafa606f1769fa1e6f894441
- http://source.android.com/security/bulletin/2016-04-02.html
- RHSA-2014:1998 vendor-advisory
- 36266 exploit
- RHSA-2014:2028 vendor-advisory
- RHSA-2014:2031 vendor-advisory
- 115919 vdb-entry
- [oss-security] 20141215 Linux kernel: multiple x86_64 vulnerabilities mailing-list
- SUSE-SU-2015:0812 vendor-advisory