QwikSec

Security Database

CVE

CWE

Training

CVE-2014-9645

Published: Mar 12, 2017

Modified: Aug 6, 2024

PUBLISHED

Description

The add_probe function in modutils/modprobe.c in BusyBox before 1.23.0 allows local users to bypass intended restrictions on loading kernel modules via a / (slash) character in a module name, as demonstrated by an "ifconfig /usbserial up" command or a "mount -t /snd_pcm none /" command.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

https://plus.google.com/+MathiasKrause/posts/PqFCo4bfrWu

x_refsource_MISC

https://bugs.busybox.net/show_bug.cgi?id=7652

x_refsource_CONFIRM

[oss-security] 20150124 Re: CVE Request: Linux kernel crypto api unprivileged arbitrary module load

mailing-list

x_refsource_MLIST

vendor-advisory

x_refsource_GENTOO

vdb-entry

x_refsource_BID

https://bugzilla.redhat.com/show_bug.cgi?id=1185707

x_refsource_CONFIRM

[debian-lts-announce] 20180727 [SECURITY] [DLA 1445-1] busybox security update

mailing-list

x_refsource_MLIST

http://git.busybox.net/busybox/commit/?id=4e314faa0aecb66717418e9a47a4451aec59262b

x_refsource_CONFIRM

vendor-advisory

x_refsource_UBUNTU

20200313 SEC Consult SA-20200312-0 :: Authenticated Command Injection in Phoenix Contact TC Router & TC Cloud Client

mailing-list

x_refsource_FULLDISC

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.